All Apps and Add-ons

Local variable 'data' referenced before assignment

jaxjohnny2000
Builder

Fellow OMS Splunkers, what do you think about these messages?

Using: Type=SecurityBaseline AnalyzeResult=Failed

06-28-2019 15:57:21.704 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" ERRORlocal variable 'data' referenced before assignment


06-28-2019 15:57:21.677 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py" UnboundLocalError: local variable 'data' referenced before assignment

06-28-2019 15:57:21.677 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py"     for i in range(len(data["tables"][0]["rows"])):

Using: AzureActivity | summarize count() by Category

2019-06-28 15:58:54,518 ERROR pid=130483 tid=MainThread file=base_modinput.py:log_error:307 | Get error when collecting events.
Traceback (most recent call last):
  File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/ta_ms_loganalytics/modinput_wrapper/base_modinput.py", line 127, in stream_events
    self.collect_events(ew)
  File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/log_analytics.py", line 96, in collect_events
    input_module.collect_events(self, ew)
  File "/opt/splunk/etc/apps/TA-ms-loganalytics/bin/input_module_log_analytics.py", line 86, in collect_events
    for i in range(len(data["tables"][0]["rows"])):
UnboundLocalError: local variable 'data' referenced before assignment
1 Solution

jkat54
SplunkTrust
SplunkTrust

fillermark
New Member

In Python, variables that are only referenced inside a function are implicitly global. If a variable is assigned a value anywhere within the function’s body, it’s assumed to be a local unless explicitly declared as global. The unboundlocalerror: local variable referenced before assignment is raised when you try to use a variable before it has been assigned in the local context. All variable assignments in a function store the value in the local symbol table; whereas variable references first look in the local symbol table, then in the global symbol table, and then in the table of built-in names. Thus, global variables cannot be directly assigned a value within a function (unless named in a global statement), although they may be referenced.

 

0 Karma

jkat54
SplunkTrust
SplunkTrust

Read how @Esky73 solved the problem using legacy OMS query language here:

https://answers.splunk.com/answers/700795/v103-seeing-a-get-error-when-collecting-events.html

jkat54
SplunkTrust
SplunkTrust

You're getting a 404 not found on the post to the API

Try changing your config so that this

SPZE2HSTPRD001OMSLogAnalytics

Is the GUID for the workspace instead of the name.

0 Karma

jaxjohnny2000
Builder

This was the answer! use the Workspace ID GUID to retrieve data!!!

jkat54
SplunkTrust
SplunkTrust

I think it works this way for some and then the other way for others because I had it working with the GUID in my env and someone else said it should be the name and that's how they got it working, so then I updated the code to ask for the name and now it seems to want the ID for you... oh well now we know!

Thanks for checking!

0 Karma

jkat54
SplunkTrust
SplunkTrust

Please leave me a review on LinkedIn if this app made your life easier 🙂

0 Karma

jaxjohnny2000
Builder

More errors to help.

2019-06-28 16:30:36,740 DEBUG pid=24441 tid=MainThread file=connectionpool.py:_make_request:400 | https://api.loganalytics.io:443 "POST /v1/workspaces/PRD001OMSLogAnalytics/query HTTP/1.1" 404 84

jkat54
SplunkTrust
SplunkTrust

Good idea turning on debug! That got us to the solution!

0 Karma

jaxjohnny2000
Builder

UnboundLocalError: local variable 'data' referenced before assignment

ERRORlocal variable 'data' referenced before assignment

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...