All Apps and Add-ons

Local variable 'data' referenced before assignment

jaxjohnny2000
Builder

Fellow OMS Splunkers, what do you think about these messages?

Using: Type=SecurityBaseline AnalyzeResult=Failed

06-28-2019 15:57:21.704 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" ERRORlocal variable 'data' referenced before assignment


06-28-2019 15:57:21.677 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" UnboundLocalError: local variable 'data' referenced before assignment

06-28-2019 15:57:21.677 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py"     for i in range(len(data["tables"][0]["rows"])):

Using: AzureActivity | summarize count() by Category

2019-06-28 15:58:54,518 ERROR pid=130483 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events.
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/ta_ms_loganalytics/modinput_wrapper/base_modinput.py", line 127, in stream_events
    self.collect_events(ew)
  File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py", line 96, in collect_events
    input_module.collect_events(self, ew)
  File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/input_module_log_analytics.py", line 86, in collect_events
    for i in range(len(data["tables"][0]["rows"])):
UnboundLocalError: local variable 'data' referenced before assignment
1 Solution

jkat54
SplunkTrust
SplunkTrust

fillermark
New Member

In Python, variables that are only referenced inside a function are implicitly global. If a variable is assigned a value anywhere within the function’s body, it’s assumed to be a local unless explicitly declared as global. The unboundlocalerror: local variable referenced before assignment is raised when you try to use a variable before it has been assigned in the local context. All variable assignments in a function store the value in the local symbol table; whereas variable references first look in the local symbol table, then in the global symbol table, and then in the table of built-in names. Thus, global variables cannot be directly assigned a value within a function (unless named in a global statement), although they may be referenced.

 

0 Karma

jkat54
SplunkTrust
SplunkTrust

Read how @Esky73 solved the problem using legacy OMS query language here:

https://answers.splunk.com/answers/700795/v103-seeing-a-get-error-when-collecting-events.html

jkat54
SplunkTrust
SplunkTrust

You're getting a 404 not found on the post to the API

Try changing your config so that this

SPZE2HSTPRD001OMSLogAnalytics

Is the GUID for the workspace instead of the name.

0 Karma

jaxjohnny2000
Builder

This was the answer! use the Workspace ID GUID to retrieve data!!!

jkat54
SplunkTrust
SplunkTrust

I think it works this way for some and then the other way for others because I had it working with the GUID in my env and someone else said it should be the name and that's how they got it working, so then I updated the code to ask for the name and now it seems to want the ID for you... oh well now we know!

Thanks for checking!

0 Karma

jkat54
SplunkTrust
SplunkTrust

Please leave me a review on LinkedIn if this app made your life easier 🙂

0 Karma

jaxjohnny2000
Builder

More errors to help.

2019-06-28 16:30:36,740 DEBUG pid=24441 tid=MainThread file=connectionpool.py:_make_request:400 | https://api.loganalytics.io:443 "POST /v1/workspaces/PRD001OMSLogAnalytics/query HTTP/1.1" 404 84

jkat54
SplunkTrust
SplunkTrust

Good idea turning on debug! That got us to the solution!

0 Karma

jaxjohnny2000
Builder

UnboundLocalError: local variable 'data' referenced before assignment

ERRORlocal variable 'data' referenced before assignment

Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...