All Apps and Add-ons

ERROR FrameworkUtils - Incorrect path to script, no data is received

halr9000
Motivator

No NetApp data is shown on dashboards, and I receive the following data in splunkd log:

02-20-2013 14:38:03.476 -0500 ERROR FrameworkUtils - Incorrect path to script: D:\Program Files\Splunk/etc/apps/SplunkAppforNetApp/bin/SNap.py.  Script must be located inside $SPLUNK_HOME\bin\scripts.
02-20-2013 14:38:03.476 -0500 ERROR ExecProcessor - Ignoring: ""D:\Program Files\Splunk/etc/apps/SplunkAppforNetApp/bin/SNap.py""

Splunk server platform is Windows

0 Karma
1 Solution

halr9000
Motivator

This is a Splunk-on-Windows thing that will be made easier and more clear at release. Today, inputs.conf is very picky with the forward/reverse slashes. Hopefully this will be more transparent in future versions of Splunk, but for now, we have to change the slashes.

For example, in the app under default/inputs.conf:

[script://$SPLUNK_HOME/etc/apps/SplunkAppforNetApp/bin/SNap.py]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp

Everything should work fine if we change the slashes like so:

[script://$SPLUNK_HOME\etc\apps\SplunkAppforNetApp\bin\SNap.py]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp

Note that the first two slashes remain forward.

This is an odd case that will be resolved more gracefully, but for now, the best solution is to change default/inputs.conf so that the last stanza looks like the above. Note that you can fix this by adding a stanza to local/inputs.conf, but as the slashes are different, a local config will not match, so you would end up with two stanzas (one broken, one functional) where you only want one.

View solution in original post

halr9000
Motivator

This is a Splunk-on-Windows thing that will be made easier and more clear at release. Today, inputs.conf is very picky with the forward/reverse slashes. Hopefully this will be more transparent in future versions of Splunk, but for now, we have to change the slashes.

For example, in the app under default/inputs.conf:

[script://$SPLUNK_HOME/etc/apps/SplunkAppforNetApp/bin/SNap.py]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp

Everything should work fine if we change the slashes like so:

[script://$SPLUNK_HOME\etc\apps\SplunkAppforNetApp\bin\SNap.py]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp

Note that the first two slashes remain forward.

This is an odd case that will be resolved more gracefully, but for now, the best solution is to change default/inputs.conf so that the last stanza looks like the above. Note that you can fix this by adding a stanza to local/inputs.conf, but as the slashes are different, a local config will not match, so you would end up with two stanzas (one broken, one functional) where you only want one.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...