topic Re: Unable to execute python script - could be splunk lib path issue in Splunk Dev

Unable to execute python script - could be splunk lib path issue

kamal_jagga — Tue, 22 Mar 2016 20:31:38 GMT

Hi,

I am trying to run a python script. The script works fine in lower environment and i am trying to move it to higher. I am able to execute other python scripts normally in both env.

I was able to run the script in lower env by specifying the splunk path in front of it.

/opt/splunk/bin/splunk cmd python command_test.py

So, while i am trying to execute it in higher using the same way. Its giving error.

Traceback (most recent call last):
File "command_test.py", line 4, in
from splunklib.searchcommands import \
ImportError: No module named splunklib.searchcommands

Now someone in my team has told me that splunk lib path might have been set in lower environment.

Would anyone be able to advise on where and what to set the path. Or any other way to fix the issue.

Re: Unable to execute python script - could be splunk lib path issue

MuS — Wed, 23 Mar 2016 02:30:02 GMT

Take a look at this answer https://answers.splunk.com/answers/243498/getinfo-probe-failed-for-external-search-command-a.html

cheers, MuS

Re: Unable to execute python script - could be splunk lib path issue

kamal_jagga — Tue, 29 Sep 2020 09:12:05 GMT

I checked the answer, for higher environment we don't have the required files. So, i think that's why we are not able to run it. But in lower env, we have the required files (init.py & init.pyc) in the splunklib/searchcommands

Interestingly splunk is also not able to run the script in lower environment.

I am able to run the command as:
/opt/splunk_1/bin/splunk cmd python command_test

But not as
python command_test

So, I need a way to splunk execute the script as "/opt/splunk_1/bin/splunk cmd python command_test " rather than "python command_test ".

Kindly advise.

Re: Unable to execute python script - could be splunk lib path issue

somesoni2 — Fri, 25 Mar 2016 17:16:07 GMT

Can you provide the script code, if it doesn't contain anything sensitive?

Re: Unable to execute python script - could be splunk lib path issue

kbarker302 — Tue, 29 Mar 2016 17:38:24 GMT

I wonder if you are missing the PYTHONPATH environment variable in your higher environment. This is what it is set to for me:

PYTHONPATH=C:\Program Files\Splunk\bin;C:\Program Files\Splunk\Python-2.7\Lib\site-packages\win32;C:\Program Files\Splunk\Python-2.7\Lib\site-packages;C:\Program Files\Splunk\Python-2.7\Lib;C:\Program Files\Splunk\etc\apps\framework\contrib\splunk-sdk-python

Re: Unable to execute python script - could be splunk lib path issue

kamal_jagga — Tue, 29 Sep 2020 09:21:43 GMT

Hey. PFB the code. I just want to pass the two arguments received from Search bar to my python script.

!/opt/splunk/bin/python2.7

import sys, time

import splunk.Intersplunk

import getopt
from splunklib.searchcommands import \
dispatch, GeneratingCommand, Configuration, Option, validators
def main(argv):

print("hello")
opts, args = getopt.getopt(argv,["ifile=","ofile="])
for arg in args :
print (arg)
main(sys.argv[1:])

And in my commands.conf. i have
[generatehello]
filename = command_test
supports_getinfo = true
supports_rawargs = true
outputheader = true

Command line Output :
splunk~/bin]$ /opt/splunk/bin/splunk cmd python command_test file1 file2
hello
file1
file2

Re: Unable to execute python script - could be splunk lib path issue

somesoni2 — Tue, 05 Apr 2016 17:39:18 GMT

Try something like this

command_test.py

import sys, splunk.Intersplunk, csv, urllib2, base64

keywords, argvals = splunk.Intersplunk.getKeywordsAndOptions()
file1 = argvals.get("file1", None)
file2 = argvals.get("file2", "csv")

if not file1:
   splunk.Intersplunk.parseError("'file1' argument not provided.")
if not file2:
   splunk.Intersplunk.parseError("'file2' argument not provided.")

results = []    
try:
    results.append('Hello ')
    results.append('File1 passed is %s ' % ( file1 ))
    results.append('File2 passed is %s ' % ( file2 ))
except Exception, e:
   splunk.Intersplunk.parseError(e)

results = [{'search' : disjuncts}]
splunk.Intersplunk.outputResults(results)

commands.conf

[generatehello]
filename = command_test.py
generating = true
local = true
supports_rawargs = false

Usage

splunk~/bin]$ /opt/splunk/bin/splunk cmd python command_test file1=file1 file2=file2

In search

| generatehello file1=file1 file2=file2

Re: Unable to execute python script - could be splunk lib path issue

kartik13 — Tue, 05 Apr 2016 17:47:08 GMT

I had a same problem.First Check your Splunk and Python Path .secondly check on which port python is running .Or some other application is running on the same port.

Re: Unable to execute python script - could be splunk lib path issue

kamal_jagga — Wed, 20 Apr 2016 18:31:01 GMT

Hey,

Thanks a lot for replying and apologies for the late reply.

I am getting an error and wasn't able to research much on the below issue.
Error:
Traceback (most recent call last):
File "command_test1.py", line 20, in
results = [{'search' : disjuncts}]
NameError: name 'disjuncts' is not defined

Re: Unable to execute python script - could be splunk lib path issue

kamal_jagga — Tue, 26 Apr 2016 21:53:25 GMT

@somesoni2 : Kindly advise.

Re: Unable to execute python script - could be splunk lib path issue

ryanoconnor — Sun, 02 Oct 2016 13:25:57 GMT

Same issue this isn't working

Re: Unable to execute python script - could be splunk lib path issue

joelurtubia — Tue, 29 Sep 2020 16:36:44 GMT

Hello, I was the same problem with Mysql module that I was install on my Centos server

Splunk didn't work with this library, because splunk has they own python library...then you can fix it only added on the begin your script all libraries of python and also you must to add the python Centos library too... as this way

Find python packages

[root@xxxx]#find / -name site-packages
/usr/lib/python2.7/site-packages
/usr/lib64/python2.7/site-packages
/opt/splunk/etc/apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/lib/python2.7/site-packages
/opt/splunk/lib/python2.7/site-packages

Find python binary

[root@xxxx]# whereis python
python: /usr/bin/python2.7 /usr/bin/python /usr/lib/python2.7 /usr/lib64/python2.7 /etc/python /usr/include/python2.7 /opt/splunk/bin/python /opt/splunk/bin/python2.7 /usr/share/man/man1/python.1.gz

include all at begin your script

import sys
sys.path.append('/usr/bin/python2.7')
sys.path.append('/usr/lib/python2.7/site-packages')
sys.path.append('/usr/lib64/python2.7/site-packages')

And that's it , you can run mysql module without any problem and create your alerts with this module.

Mysql Connection

import mysql.connector

I hope that this fix will help you
Joel Urtubia Ugarte