Building for the Splunk Platform

Why do I get the following import ERROR when I create a custom search command with a Python script?

aiacobelli
Explorer

Greetings!

I am writing a Python script to create a custom search command that goes out and reaches out to an API to get some data back based on what is passed to it. Whenever I run the script via /opt/splunk/bin/splunk cmd python splunk.py, I get the following import error:

Traceback (most recent call last):
  File "splunk.py", line 2, in <module>
    import splunk.Intersplunk
  File "/opt/splunk/etc/apps/duoSearch/bin/splunk.py", line 2, in <module>
    import splunk.Intersplunk
ImportError: No module named Intersplunk

When I open up the interpreter via /opt/splunk/bin/splunk cmd python and try to import it there via import splunk.Intersplunk , I do not get an error.

0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi @aiacobelli,

I replicated same issue in my lab environment. Please rename your python file name to something else like splunk123.py . Also remove splunk.pyc file from directory /opt/splunk/etc/apps/duoSearch/bin/ and it will work.

Thanks,
Harshil

View solution in original post

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @aiacobelli,

I replicated same issue in my lab environment. Please rename your python file name to something else like splunk123.py . Also remove splunk.pyc file from directory /opt/splunk/etc/apps/duoSearch/bin/ and it will work.

Thanks,
Harshil

0 Karma

aiacobelli
Explorer

Thank you! That did it!

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...