All Apps and Add-ons

Local variable 'data' referenced before assignment

jaxjohnny2000
Builder

Fellow OMS Splunkers, what do you think about these messages?

Using: Type=SecurityBaseline AnalyzeResult=Failed

06-28-2019 15:57:21.704 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" ERRORlocal variable 'data' referenced before assignment


06-28-2019 15:57:21.677 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" UnboundLocalError: local variable 'data' referenced before assignment

06-28-2019 15:57:21.677 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py"     for i in range(len(data["tables"][0]["rows"])):

Using: AzureActivity | summarize count() by Category

2019-06-28 15:58:54,518 ERROR pid=130483 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events.
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/ta_ms_loganalytics/modinput_wrapper/base_modinput.py", line 127, in stream_events
    self.collect_events(ew)
  File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py", line 96, in collect_events
    input_module.collect_events(self, ew)
  File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/input_module_log_analytics.py", line 86, in collect_events
    for i in range(len(data["tables"][0]["rows"])):
UnboundLocalError: local variable 'data' referenced before assignment
1 Solution

jkat54
SplunkTrust
SplunkTrust

fillermark
New Member

In Python, variables that are only referenced inside a function are implicitly global. If a variable is assigned a value anywhere within the function’s body, it’s assumed to be a local unless explicitly declared as global. The unboundlocalerror: local variable referenced before assignment is raised when you try to use a variable before it has been assigned in the local context. All variable assignments in a function store the value in the local symbol table; whereas variable references first look in the local symbol table, then in the global symbol table, and then in the table of built-in names. Thus, global variables cannot be directly assigned a value within a function (unless named in a global statement), although they may be referenced.

 

0 Karma

jkat54
SplunkTrust
SplunkTrust

Read how @Esky73 solved the problem using legacy OMS query language here:

https://answers.splunk.com/answers/700795/v103-seeing-a-get-error-when-collecting-events.html

jkat54
SplunkTrust
SplunkTrust

You're getting a 404 not found on the post to the API

Try changing your config so that this

SPZE2HSTPRD001OMSLogAnalytics

Is the GUID for the workspace instead of the name.

0 Karma

jaxjohnny2000
Builder

This was the answer! use the Workspace ID GUID to retrieve data!!!

jkat54
SplunkTrust
SplunkTrust

I think it works this way for some and then the other way for others because I had it working with the GUID in my env and someone else said it should be the name and that's how they got it working, so then I updated the code to ask for the name and now it seems to want the ID for you... oh well now we know!

Thanks for checking!

0 Karma

jkat54
SplunkTrust
SplunkTrust

Please leave me a review on LinkedIn if this app made your life easier 🙂

0 Karma

jaxjohnny2000
Builder

More errors to help.

2019-06-28 16:30:36,740 DEBUG pid=24441 tid=MainThread file=connectionpool.py:_make_request:400 | https://api.loganalytics.io:443 "POST /v1/workspaces/PRD001OMSLogAnalytics/query HTTP/1.1" 404 84

jkat54
SplunkTrust
SplunkTrust

Good idea turning on debug! That got us to the solution!

0 Karma

jaxjohnny2000
Builder

UnboundLocalError: local variable 'data' referenced before assignment

ERRORlocal variable 'data' referenced before assignment

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...