Local variable 'data' referenced before assignment

[jaxjohnny2000]

Fellow OMS Splunkers, what do you think about these messages?

Using: Type=SecurityBaseline AnalyzeResult=Failed

06-28-2019 15:57:21.704 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" ERRORlocal variable 'data' referenced before assignment


06-28-2019 15:57:21.677 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" UnboundLocalError: local variable 'data' referenced before assignment

06-28-2019 15:57:21.677 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py"     for i in range(len(data["tables"][0]["rows"])):

Using: AzureActivity | summarize count() by Category

2019-06-28 15:58:54,518 ERROR pid=130483 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events.
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/ta_ms_loganalytics/modinput_wrapper/base_modinput.py", line 127, in stream_events
    self.collect_events(ew)
  File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py", line 96, in collect_events
    input_module.collect_events(self, ew)
  File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/input_module_log_analytics.py", line 86, in collect_events
    for i in range(len(data["tables"][0]["rows"])):
UnboundLocalError: local variable 'data' referenced before assignment

[fillermark]

In Python, variables that are only referenced inside a function are implicitly global. If a variable is assigned a value anywhere within the function’s body, it’s assumed to be a local unless explicitly declared as global. The unboundlocalerror: local variable referenced before assignment is raised when you try to use a variable before it has been assigned in the local context. All variable assignments in a function store the value in the local symbol table; whereas variable references first look in the local symbol table, then in the global symbol table, and then in the table of built-in names. Thus, global variables cannot be directly assigned a value within a function (unless named in a global statement), although they may be referenced.

[jkat54 · Accepted solution]

Read how @Esky73 solved the problem using legacy OMS query language here:

https://answers.splunk.com/answers/700795/v103-seeing-a-get-error-when-collecting-events.html

[jkat54]

You're getting a 404 not found on the post to the API

Try changing your config so that this

SPZE2HSTPRD001OMSLogAnalytics

Is the GUID for the workspace instead of the name.

[jaxjohnny2000]

This was the answer! use the Workspace ID GUID to retrieve data!!!

[jkat54]

I think it works this way for some and then the other way for others because I had it working with the GUID in my env and someone else said it should be the name and that's how they got it working, so then I updated the code to ask for the name and now it seems to want the ID for you... oh well now we know!

Thanks for checking!

[jkat54]

Please leave me a review on LinkedIn if this app made your life easier 🙂

[jaxjohnny2000]

More errors to help.

2019-06-28 16:30:36,740 DEBUG pid=24441 tid=MainThread file=connectionpool.py:_make_request:400 | https://api.loganalytics.io:443 "POST /v1/workspaces/PRD001OMSLogAnalytics/query HTTP/1.1" 404 84

[jkat54]

Good idea turning on debug! That got us to the solution!

[jaxjohnny2000]

UnboundLocalError: local variable 'data' referenced before assignment

ERRORlocal variable 'data' referenced before assignment