Scripted inputs are not working in Splunk

Applicability

Description

The Shell scripted input is not working in Splunk and it throws the below error once after the execution 

1) 12-14-2023 12:50:00.006 +0000 ERROR ExecProcessor [639162 ExecProcessor] - message from "/opt/splunk/etc/apps/dev_change_management_script/bin/change_ecord_collection.sh" /opt/splunk/etc/apps/dev_change_management_script/bin/change_ecord_collection.sh: line 3: ` paste -d' ' <(echo "Modified Time:") <(date -r $line) <(stat $line | grep File)'
eventtype = err0r error eventtype = splunkd-log eventtype = us_aura_error_filter aura filter ushost = gx-zu2pssdlv215source = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd2) 12-14-2023 12:50:00.006 +0000 ERROR ExecProcessor [639162 ExecProcessor] - message from "/opt/splunk/etc/apps/dev_change_management_script/bin/change_ecord_collection.sh" /opt/splunk/etc/apps/dev_change_management_script/bin/change_ecord_collection.sh: line 3: syntax error near unexpected token `('
eventtype = err0r error eventtype = splunkd-log eventtype = us_aura_error_filter aura filter ushost = gx-zu2pssdlv215source = /opt/splunk/var/log/splunk/splunkd.logsourcetype = splunkd3)12-14-2023 12:50:00.002 +0000 INFO ExecProcessor [639162 ExecProcessor] - setting reschedule_ms=299998, for command=/opt/splunk/etc/apps/dev_change_management_script/bin/change_ecord_collection.sh

Investigation

--> Ran the command which is showing in the mentioned error in CLI and checked whether it is executing successfully

For example like below:

admin@hostname# paste -d' ' <(echo "Modified Time:") <(date -r $line) <(stat $line | grep File)

If the above process is successful, then we can confirm that there is no issue in the command lines in script.

Resolution

We have to add #!/bin/bash in the script first line mentioned below and that will force the script to use bash as the cmd interpreter and should work as it’s a best practice to assert the interpreter in the script, since the default interpreter may vary across different boxes.

The below is the example to update the script to execute successfully:

#!/bin/bash
while read line
do
paste -d' ' <(echo "Modified Time:") <(date -r $line) <(stat $line | grep File)
done < <(find /opt/splunk/etc/shcluster/apps/ -type f -mmin -5)