topic Re: Why am I receiving ModuleNotFoundError with custom module? in Splunk Search

Why am I receiving ModuleNotFoundError with custom module?

newrose — Wed, 17 May 2023 19:57:40 GMT

I'm trying to use a Python script with a custom module for a external lookup on Splunk. When running

/opt/splunk/bin/splunk cmd python /opt/splunk/etc/apps/search/bin/gib_detect.py

to test the script I get the following error:

Traceback (most recent call last): File "/opt/splunk/etc/apps/search/bin/gib_detect.py", line 18, in <module> import gib_detect_train ModuleNotFoundError: No module named 'gib_detect_train'

But when running the same script outside Splunk folders with

/opt/splunk/bin/splunk cmd python /home/myuser/gib_detect.py

It works as intended.

What I am doing wrong?

Re: Why am I receiving ModuleNotFoundError with custom module?

richgalloway — Wed, 17 May 2023 20:06:36 GMT

Did you include gib_detect.py in /opt/splunk/etc/apps/search/lib? It's probably in your home folder, but not in the Splunk folder.

BTW, it's best to create external commands in custom apps rather than in the search app.

Re: Why am I receiving ModuleNotFoundError with custom module?

newrose — Wed, 17 May 2023 20:30:58 GMT

I have this same .py file both in my home directory and inside /opt/splunk/etc/apps/search/bin.

Should I create a lib folder inside the search app to store the .py file? Shouldn't the binaries be stored inside a bin folder?

Re: Why am I receiving ModuleNotFoundError with custom module?

richgalloway — Wed, 17 May 2023 20:39:31 GMT

Library files can be in <app>/bin/lib or <app>/lib.

I would resist the temptation to change the file structure of a standard app. Put your external command into a new app.

Re: Why am I receiving ModuleNotFoundError with custom module?

newrose — Wed, 17 May 2023 20:53:00 GMT

That was my bad. The import is actually calling another file, the gib_detect_train.py, and was required inside the bin folder as well.

And I will be following the @richgalloway advice of storing the files in a custom app.

Re: Why am I receiving ModuleNotFoundError with custom module?

newrose — Wed, 17 May 2023 20:57:57 GMT

I appreciate your help.

I didn't provide all the detais about the script, and actually was missing another file inside the bin folder.

I'll be using a custom app to keep the search app folder clean.