All Apps and Add-ons

ERROR FrameworkUtils - Incorrect path to script, no data is received

halr9000
Motivator

No NetApp data is shown on dashboards, and I receive the following data in splunkd log:

02-20-2013 14:38:03.476 -0500 ERROR FrameworkUtils - Incorrect path to script: D:\Program Files\Splunk/etc/apps/SplunkAppforNetApp/bin/SNap.py.  Script must be located inside $SPLUNK_HOME\bin\scripts.
02-20-2013 14:38:03.476 -0500 ERROR ExecProcessor - Ignoring: ""D:\Program Files\Splunk/etc/apps/SplunkAppforNetApp/bin/SNap.py""

Splunk server platform is Windows

0 Karma
1 Solution

halr9000
Motivator

This is a Splunk-on-Windows thing that will be made easier and more clear at release. Today, inputs.conf is very picky with the forward/reverse slashes. Hopefully this will be more transparent in future versions of Splunk, but for now, we have to change the slashes.

For example, in the app under default/inputs.conf:

[script://$SPLUNK_HOME/etc/apps/SplunkAppforNetApp/bin/SNap.py]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp

Everything should work fine if we change the slashes like so:

[script://$SPLUNK_HOME\etc\apps\SplunkAppforNetApp\bin\SNap.py]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp

Note that the first two slashes remain forward.

This is an odd case that will be resolved more gracefully, but for now, the best solution is to change default/inputs.conf so that the last stanza looks like the above. Note that you can fix this by adding a stanza to local/inputs.conf, but as the slashes are different, a local config will not match, so you would end up with two stanzas (one broken, one functional) where you only want one.

View solution in original post

halr9000
Motivator

This is a Splunk-on-Windows thing that will be made easier and more clear at release. Today, inputs.conf is very picky with the forward/reverse slashes. Hopefully this will be more transparent in future versions of Splunk, but for now, we have to change the slashes.

For example, in the app under default/inputs.conf:

[script://$SPLUNK_HOME/etc/apps/SplunkAppforNetApp/bin/SNap.py]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp

Everything should work fine if we change the slashes like so:

[script://$SPLUNK_HOME\etc\apps\SplunkAppforNetApp\bin\SNap.py]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp

Note that the first two slashes remain forward.

This is an odd case that will be resolved more gracefully, but for now, the best solution is to change default/inputs.conf so that the last stanza looks like the above. Note that you can fix this by adding a stanza to local/inputs.conf, but as the slashes are different, a local config will not match, so you would end up with two stanzas (one broken, one functional) where you only want one.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...