Splunk Dev

Unable to run python script

jayakumar19
Observer

Unable to run python script with inputs.conf, getting below errors

03-21-2019 10:11:03.474 -0400 ERROR ExecProcessor - message from "python $Splunk_home/etc/apps/XX/bin/X.py" File "$Splunk_home/etc/apps/XX/bin/X.py", line 100, in
03-21-2019 10:11:03.474 -0400 ERROR ExecProcessor - message from "python $Splunk_home/etc/apps/XX/bin/X.py" fileIo = open(logFile,'w')
03-21-2019 10:11:03.474 -0400 ERROR ExecProcessor - message from "python $Splunk_home/etc/apps/XX/bin/X.py" IOError: [Errno 13] Permission denied: u'.//21_03_2019-10_11_02-datafeed.json'

But I can run script manually. $Splunk_home/bin/splunk cmd python $Splunk_home/etc/apps/XX/bin/X.py

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi jayakumar19,

Usually I do this to test/troubleshoot scripts in Splunk:

 $SPLUNK_HOME/bin/splunk cmd /bin/bash

This will start a shell session with all Splunk environment settings. Then I start the script like this:

$SPLUNK_HOME/bin/splunk cmd $SPLUNK_HOME/etc/apps/XX/bin/X.py

This helps a lot to understand where and/or why scripts fail to run.

In addition I add logging lines into the script that will tell me variables being used and which step is being processed. You can add them like this:

logging.debug('what ever you want to show in the logfile')

Hope that helps ...

cheers, MuS

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Are you running script manually with same user as splunk process is running ?

0 Karma

jayakumar19
Observer

Thanks Harsmarvania for looking into it. Yes I am running it as splunk user.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Based on logs which you have provided it is saying that splunk process which is running as splunk user doesn't have permission to read 21_03_2019-10_11_02-datafeed.json file.

0 Karma

jayakumar19
Observer

Actually script is trying to create that file. Manual run is able to create new file.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

That's strange, in which directory splunk tries to create file using that script ?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...