Hi,
Just installed the app on a universal forwarder and getting this error in the log. Any idea what the issue is? Is there any configuration I need to edit other than inputs.conf? Thanks.
Server has Python 2.7.5 and I created symlink: splunkforwarder/bin/python2.7 -> /usr/bin/python
file_meta_data_modular_input.log
:
2020-05-27 13:04:35,867 ERROR Execution failed
Traceback (most recent call last):
File "/home/opc/splunk/splunkforwarder/etc/apps/file_meta_data/bin/modular_input.zip/modular_input/modular_input_base_class.py", line 1095, in execute
self.do_run(in_stream, log_exception_and_continue=True)
File "/home/opc/splunk/splunkforwarder/etc/apps/file_meta_data/bin/modular_input.zip/modular_input/modular_input_base_class.py", line 976, in do_run
self.run(stanza, cleaned_params, input_config)
File "/home/opc/splunk/splunkforwarder/etc/apps/file_meta_data/bin/file_meta_data.py", line 621, in run
file_filter=file_filter)
TypeError: get_file_data() got an unexpected keyword argument 'file_filter'
inputs.conf:
[file_meta_data://vendor_data]
interval = 5m
file_hash_limit = 500MB
file_path = /home/vendor_files/
recurse = 0
only_if_changed = 0
include_file_hash = 0
disabled = 0
UPDATE:
I looked at the code file_meta_data.py, and removed the file_filter=file_filter in these lines. That seems working.
if recurse:
results, new_latest_time = self.get_files_data(file_path, logger=self.logger,
latest_time=latest_time,
must_be_later_than=must_be_later_than,
file_hash_limit=file_hash_limit,
depth_limit=depth_limit)
else:
result, new_latest_time = self.get_file_data(file_path, logger=self.logger,
latest_time=latest_time,
must_be_later_than=must_be_later_than,
file_hash_limit=file_hash_limit)