topic Re: Using Lookup in Python SDK in Splunk Dev

Using Lookup in Python SDK

MK3 — Thu, 22 Aug 2024 16:03:30 GMT

Hello,

I have a query -

searchquery_oneshot = "search (index=__* ... events{}.name=ResourceCreated) | dedup \"events{}.tags.A\" | spath \"events{}.tags.A\" || lookup Map.csv \"B\" OUTPUT \"D\" | table ... | collect ...

I ran this using Python SDK in VSCode as -

oneshotsearch_results = service.jobs.oneshot(searchquery_oneshot, **kwargs_oneshot) conn.cursor().execute(sql, val)

I ran the above using psycopg2 and got this error-
FATAL: Error in 'lookup' command: Could not construct lookup 'Map.csv, B, OUTPUT, D'. See search.log for more details.

The above query works when run inside splunk enterprise i.e. map.csv is looked-up and result fetched correctly.
How do I locate my search.log? It is splunkhome/var/lib/dispatch/run I assume. What is the error above?

Thanks

Re: Using Lookup in Python SDK

ITWhisperer — Fri, 23 Aug 2024 07:39:02 GMT

Have you tried using a kv store instead of csv as I know that csv lookup don't work for python custom commands?

Re: Using Lookup in Python SDK

VatsalJagani — Sun, 25 Aug 2024 05:14:21 GMT

@MK3- I believe its an permission and/or app-context issue.

When you create service object,

Provide the same username you use to login on Splunk UI
Provide the same App name which you use on UI and search works fine

service = client.connect(host="<ip/hostname>", username="<username>", password="<user-passwd", app="<same app as you use on UI>")

I hope this helps!!!!