Fellow OMS Splunkers, what do you think about these messages?
Using: Type=SecurityBaseline AnalyzeResult=Failed
06-28-2019 15:57:21.704 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" ERRORlocal variable 'data' referenced before assignment
06-28-2019 15:57:21.677 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" UnboundLocalError: local variable 'data' referenced before assignment
06-28-2019 15:57:21.677 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" for i in range(len(data["tables"][0]["rows"])):
Using: AzureActivity | summarize count() by Category
2019-06-28 15:58:54,518 ERROR pid=130483 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events.
Traceback (most recent call last):
File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/ta_ms_loganalytics/modinput_wrapper/base_modinput.py", line 127, in stream_events
self.collect_events(ew)
File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py", line 96, in collect_events
input_module.collect_events(self, ew)
File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/input_module_log_analytics.py", line 86, in collect_events
for i in range(len(data["tables"][0]["rows"])):
UnboundLocalError: local variable 'data' referenced before assignment
Read how @Esky73 solved the problem using legacy OMS query language here:
https://answers.splunk.com/answers/700795/v103-seeing-a-get-error-when-collecting-events.html
In Python, variables that are only referenced inside a function are implicitly global. If a variable is assigned a value anywhere within the function’s body, it’s assumed to be a local unless explicitly declared as global. The unboundlocalerror: local variable referenced before assignment is raised when you try to use a variable before it has been assigned in the local context. All variable assignments in a function store the value in the local symbol table; whereas variable references first look in the local symbol table, then in the global symbol table, and then in the table of built-in names. Thus, global variables cannot be directly assigned a value within a function (unless named in a global statement), although they may be referenced.
Read how @Esky73 solved the problem using legacy OMS query language here:
https://answers.splunk.com/answers/700795/v103-seeing-a-get-error-when-collecting-events.html
You're getting a 404 not found on the post to the API
Try changing your config so that this
SPZE2HSTPRD001OMSLogAnalytics
Is the GUID for the workspace instead of the name.
This was the answer! use the Workspace ID GUID to retrieve data!!!
I think it works this way for some and then the other way for others because I had it working with the GUID in my env and someone else said it should be the name and that's how they got it working, so then I updated the code to ask for the name and now it seems to want the ID for you... oh well now we know!
Thanks for checking!
Please leave me a review on LinkedIn if this app made your life easier 🙂
More errors to help.
2019-06-28 16:30:36,740 DEBUG pid=24441 tid=MainThread file=connectionpool.py:_make_request:400 | https://api.loganalytics.io:443 "POST /v1/workspaces/PRD001OMSLogAnalytics/query HTTP/1.1" 404 84
Good idea turning on debug! That got us to the solution!
UnboundLocalError: local variable 'data' referenced before assignment
ERRORlocal variable 'data' referenced before assignment