Forums: SplunkAdministration: Scripted Inputs Not Running

I have looked through previous forums and tried to modify what I have <see below> to match what as in the doc and also what was shown in a previous Forum posting....all to no avail.

Here is what I have:

/opt/splunk/etc/app/scripts/bin/hastatus-sum.sh (chmod'd to +x)
#!/bin/sh
# grab a snapshot of what is online in which server.
/opt/VRTS/bin/hastatus -sum # test confirms this runs

/opt/splunk/etc/app/scripts/inputs.conf
[script://opt/splunk/etc/apps/scripts/bin/hastatus-sum.sh]
interval = 30 # run every 30 seconds
index = main
sourcetype = hastatus-sum # set sourcetype to hastatus
disabled = false

/opt/splunk/etc/app/scripts/props.conf
[hastatus-sum]
BREAK_ONLY_BEFORE = gobblygook
DATETIME_CONFIG = CURRENT

Nothing shows in the splunkd.log file as failing. Nothing shows that it is trying to run either.
Am I missing something? I have stop/started Splunk each time I make changes.

Help.

Follow-up question: why do you add these entries to seperate inputs.conf and props.conf files and not utilize the ones inside ../local/ ?
Curious.

Regards.

...and another Follow-up.
From Splunks own docs I found the following:

http://www.splunk.com/doc/3.3/admin/inputsconfspec

../inputs.conf file
#**

1. Scripted Input:

#**

[script://<cmd>]
* Will run the command "cmd" at a configured interval and index the output.
* The command must reside in the <Splunk_home>/etc/bundles/$YOUR_BUNDLE/bin directory.

The last line indicates I should put my scripts in ../$your_bundle/bin while another page points to:
http://www.splunk.com/doc/3.3/admin/Scripted%20Inputs
* All scripts should be run out of a bin/ directory inside your application directory:
* $ mkdir $SPLUNK_HOME/etc/apps/scripts/bin

Can you please set the location for the scripts and the correct location of the inputs.conf file and the props.conf file or update the WIKI and let me know where to find the correct information. Confused.

Regards,

Paul,

In 3.3, the correct structure should be as follows:

/opt/splunk/etc/app/your_app_name/bin/your_script.(sh|pl|py|bat|bin)
/opt/splunk/etc/app/your_app_name/local/inputs.conf
/opt/splunk/etc/app/your_app_name/local/props.conf
...

Alternatively you can put the conf files in the default directory. Let me know if this is what you were looking for.

[Revised on Wed, 23 Jul 2008 10:09:12 -0700]

Correction - "app" should read "apps".

If I read that correctly, with 3.2.3 we should be putting the files in /opt/splunk/etc/bundles/default?
And 3.3 we can use the new structure. Correct?

Regards,

Correction above - those should all say "apps" instead of "app".

On 3.2.3, the structure looked as follows:

/opt/splunk/etc/bundles/your_app_name/*bin*/your_script.sh
/opt/splunk/etc/bundles/your_app_name/inputs.conf
/opt/splunk/etc/bundles/your_app_name/props.conf

So the main two differences are:

- bundles are now apps
- conf files for an app need to go in a default or local folder under the main apps directory