All Apps and Add-ons

Local variable 'data' referenced before assignment

Contributor

Fellow OMS Splunkers, what do you think about these messages?

Using: Type=SecurityBaseline AnalyzeResult=Failed

06-28-2019 15:57:21.704 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" ERRORlocal variable 'data' referenced before assignment


06-28-2019 15:57:21.677 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" UnboundLocalError: local variable 'data' referenced before assignment

06-28-2019 15:57:21.677 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py"     for i in range(len(data["tables"][0]["rows"])):

Using: AzureActivity | summarize count() by Category

2019-06-28 15:58:54,518 ERROR pid=130483 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events.
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/ta_ms_loganalytics/modinput_wrapper/base_modinput.py", line 127, in stream_events
    self.collect_events(ew)
  File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py", line 96, in collect_events
    input_module.collect_events(self, ew)
  File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/input_module_log_analytics.py", line 86, in collect_events
    for i in range(len(data["tables"][0]["rows"])):
UnboundLocalError: local variable 'data' referenced before assignment
1 Solution

SplunkTrust
SplunkTrust

SplunkTrust
SplunkTrust

SplunkTrust
SplunkTrust

You're getting a 404 not found on the post to the API

Try changing your config so that this

SPZE2HSTPRD001OMSLogAnalytics

Is the GUID for the workspace instead of the name.

0 Karma

Contributor

This was the answer! use the Workspace ID GUID to retrieve data!!!

SplunkTrust
SplunkTrust

I think it works this way for some and then the other way for others because I had it working with the GUID in my env and someone else said it should be the name and that's how they got it working, so then I updated the code to ask for the name and now it seems to want the ID for you... oh well now we know!

Thanks for checking!

0 Karma

SplunkTrust
SplunkTrust

Please leave me a review on LinkedIn if this app made your life easier 🙂

0 Karma

Contributor

More errors to help.

2019-06-28 16:30:36,740 DEBUG pid=24441 tid=MainThread file=connectionpool.py:_make_request:400 | https://api.loganalytics.io:443 "POST /v1/workspaces/PRD001OMSLogAnalytics/query HTTP/1.1" 404 84

SplunkTrust
SplunkTrust

Good idea turning on debug! That got us to the solution!

0 Karma

Contributor

UnboundLocalError: local variable 'data' referenced before assignment

ERRORlocal variable 'data' referenced before assignment