Unable to initialize modular input "lookup_watcher"
bcronrath opened this issue · comments
Unable to initialize modular input "lookup_watcher" defined inside the app "SplunkAdmins": Introspecting scheme=lookup_watcher: script running failed (exited with code 1).
Getting the above error when doing a fresh install of the app on splunk 7. Any ideas why this might be happening?
Tested on Splunk 8 on Windows and the issue did not appear, I'll try on a 7.3.0 server on Linux and see what happens
@bcronrath tested on 7.3.0 on Linux and did not see the issue. There should by a python stacktrace in either splunkd.log or the python.log file (I believe splunkd.log) on startup.
Can you let me know what you see and which Splunk version/OS?
Splunk version is Splunk 7.0.0 (build c8a78efdd40f)
OS is CentOS release 6.9 (Final)
Unfortunately haven't had much luck finding a stack trace in the splunkd.log or python.log. I just see a bunch of entries like this in splunkd.log:
11-19-2019 17:22:29.024 -0800 ERROR ModularInputs - Introspecting scheme=lookup_watcher: script running failed (exited with code 1).
11-19-2019 17:22:29.025 -0800 ERROR ModularInputs - Unable to initialize modular input "lookup_watcher" defined inside the app "SplunkAdmins": Introspecting scheme=lookup_watcher: script running failed (exited with code 1).
Is there a way I could manually invoke the script such that it prints me a stack trace to the console?
@bcronrath perhaps try:
splunk cmd splunkd print-modinput-config lookup_watcher <yourstanza>
Or try without a stanza, there is also a --debug switch that can be used...or just try running
splunk cmd python /opt/splunk/etc/apps/SplunkAdmins/bin/lookup_watcher.py
If its a syntax problem it will not run...
Sorry for the delay on my response @gjanders (by the way I want to extend a HUGE thanks to you for all the help you provide, I've seen you also help me with other issues on splunk answers).
Running manually it's starting to become a little more clear of an error message:
Traceback (most recent call last):
File "/opt/splunk/etc/apps/SplunkAdmins/bin/lookup_watcher.py", line 2, in <module>
from six.moves import range
ImportError: No module named six.moves
Is this something I need to install via pip maybe?
Ok, I re-tested and confirmed that on startup you should be seeing something like:
11-23-2019 12:46:46.691 +1100 ERROR ModularInputs - <stderr> Introspecting scheme=lookup_watcher: Traceback (most recent call last):
Anyway, the issue is that I have imported six but not done so from the lib directory of my app that is fine on newer Splunk versions like 7.3 but not on 7.0.
I've updated:
https://github.com/gjanders/SplunkAdmins/tree/testing
With a new tgz file, I've updated:
https://github.com/gjanders/SplunkAdmins/blob/testing/bin/lookup_watcher.py
The only changes are adding:
sys.path.insert(0, os.path.join(os.path.dirname(file), "..", "lib"))
from splunklib.six.moves import range
And removing the line:
from six.moves import range
@bcronrath did you have time to test that? It should hopefully fix the issue