Python scripted lookup doesn't produce any results

ultra — Tue, 04 Jan 2011 07:41:28 GMT

Hi, I have created an scripted lookup (app) that looks up data in MongoDB and returns some results.

I have used an existing lookup (that works) as a template. When I test my lookup from the console with ~/bin/splunk cmd python lookup.py < input.csv it works (just as the other script that I used as a base), however, when searching from splunk it returns no result:

app.conf

[ui] is_visible = false label = MongoLookup

transforms.conf

[mlookup] external_cmd = lookup.py fields_list = clientuid country cref refid

Searching with: index="idx_XXXXXX" sourcetype="YYYYYYY" | lookup mlookup clientuid as userID | table userID, country

I get no results for country,cref,refid

Is there a way I could see what's splunk doing when calling my script?

Re: Python scripted lookup doesn't produce any results

Ron_Naken — Fri, 04 Feb 2011 04:03:21 GMT

The error output of scripted inputs is indexed by Splunk in the _internal index. You can search the errors with a similar search to the following:

index="_internal" error myscript.sh

You should see notices that look like "ERROR ExecProcessor", followed by the script path/name.

This data is also kept in $SPLUNK_HOME/var/log/splunk in splunkd.log.

HTH,
Ron

topic Python scripted lookup doesn't produce any results in Splunk Dev

Python scripted lookup doesn't produce any results

Re: Python scripted lookup doesn't produce any results