Splunk Dev

scripted input does not produce same results as running script manually

bkwoka
Explorer

I have a python script that queries a mongo database and pulls all the results since the last time the script ran. it then stores the date of the last event it pulled to a text file to reference later. When I run this script manually it works exactly as intended. When it runs through Splunk it never creates the text document that contains the last date pulled and for some reason it only returns the last document when it should return multiple events.

my configuration is as follows:

inputs.conf
[script://$SPLUNK_HOME/etc/apps/xdrip_mongo/bin/entries.py]
disabled = false
interval = 30
source = xdrip
sourcetype = mellitus_entry

props.conf
[mellitus_entry]
SHOULD_LINEMERGE = false

and the relevant portion of python:

try:
    f_lastDate = open('lastDate.txt', 'r')
    s_lastDate = f_lastDate.read()
    try:
        int_lastDate = int(s_lastDate)
    except ValueError:
        int_lastDate = 0
except IOError:
    int_lastDate = 0
    s_lastDate = str(int_lastDate)
f_lastDate = open('lastDate.txt', 'w')

for doc_entry in entries.find({'date': {"$gt": int_lastDate}}):
    print "_id = %s, date = %s, dateString = %s, device = %s," \
          "direction = %s, filtered = %s, noise = %s, rssi = %s," \
          "sgv = %s, type = %s, unfiltered = %s" % \
            (doc_entry['_id'],
                doc_entry['date'],
                doc_entry['dateString'],
                doc_entry['device'],
                doc_entry['direction'],
                doc_entry['filtered'],
                doc_entry['noise'],
                doc_entry['rssi'],
                doc_entry['sgv'],
                doc_entry['type'],
                doc_entry['unfiltered'])

    s_lastDate = str(doc_entry['date'])

f_lastDate.write(s_lastDate)
0 Karma
1 Solution

bkwoka
Explorer

I figured it out. The script is running with system32 as the working directory. I assumed it would be running in the /bin of the app. Once I hardcoded the absolute path it worked.

View solution in original post

0 Karma

micahkemp
Champion

Refer to a previous answers post in regards to testing your script with the same environment that will be used when the script is run for your input.

It's likely that your runtime environment looks different when you're running it manually to test and when it's run by Splunk.

0 Karma

bkwoka
Explorer

I figured it out. The script is running with system32 as the working directory. I assumed it would be running in the /bin of the app. Once I hardcoded the absolute path it worked.

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...