Scripts in $SPLUNK_HOME/bin/scripts/ being removed after upgrade

Applicability

Description

After Splunk upgrade to 9.1.5+, 9.2.3+, 9.3.5+, 9.4.0+, or 10.0+ it was found that custom scripts were missing from the $SPLUNK_HOME/bin/scripts directory.

Investigation

1)  After installing Splunk v9.2.2, creating a python script (*.py) and a shell script (*.sh) and placing them in the $SPLUNK_HOME/bin/scripts directory and then an upgrade performed for Splunk enterprise to v9.2.3. 

2) After upgrading the Splunk enterprise to 9.2.3, the shell script was missing from the path $SPLUNK_HOME/bin/scripts 

Resolution

1) This is a security enhancement in 9.1.5, 9.2.3, 9.3.5, 9.4.0 and 10.0 and above. This means *.sh and *.py/*.pyc files not in the manifest file for the Splunk version will be removed upon upgrade (i.e. Splunk created and checksum verified - in the splunk-9.4.0-6b4ebe426ca6-linux-amd64-manifest file for example), then the *.sh and *.py/*.pyc files will be removed.

2) Scripts can look to be managed in ~/etc/apps, as per reference links below.

a) Example file structure for a scripted input

b) Search Reference | script
"Scripts must be declared in the commands.conf file and be located in the $SPLUNK_HOME/etc/apps/<app_name>/bin/ directory. The script is executed using $SPLUNK_HOME/bin/python."

c) Write the script for a custom alert action for Splunk Cloud Platform or Splunk Enterprise
"Create a Python file in the /bin directory of your app. The file name must match the name of the custom alert action stanza in your app's default/alert_actions.conf file. For example, create myCustomAlertAction.py in $SPLUNK_HOME/etc/apps/<app_name>/bin."