Splunk Dev

Why is the Python script input data show no result in search?

csimonnet
New Member

Hello,
I have a python scripted input which doesn't return any result in the search and I don't understand why because I can run my script in the terminal computer with the user splunk:

splunk@splunk1:~/etc/apps/bike_sharing/bin$ python NYC_predict_bike.py

extract of the result:

[{"FCTTIME":1524250800000,"conds":"Clear","dewptm":"-5","fctcode":1,"feelslike":"5","heatindex":"-9999","hum":39,"icon":"clear","mslp":"1023","pop":0,"qpf":"0","sky":11,"snow":"0","tempm":"8","uvi":0,"wdir":"NW","windchill":"5","wspd":"19","TZ":7200000,"dock_id":"3681","capacity":0,"eightd_has_key_dispenser":false,"eightd_station_services":null,"lat":40.7151776773,"lon":-74.0376833081,"name":"Grand St","region_id":null,"rental_methods":["KEY","CREDITCARD"],"short_name":"JC102"}]

0 Karma

niketn
Legend

@csimonnet, to debug can you please try the following link to write error logs to Splunk's _internal index using sys.stderror.write to ensure that Script is executing?

https://sublimerobots.com/2017/01/simple-splunk-scripted-input-example/

sys.stderr.write("Python script is starting up\n") 

Refer to a recent answer, have you scheduled your Python scripted input in Splunk? https://answers.splunk.com/answers/628853/how-to-add-scripts-as-data-input.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

csimonnet
New Member

Thanks,
now I can see a new error:
import pandas as pd
File "/opt/splunk/etc/apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/lib/python2.7/site-packages/pandas/__init__.py", line 13, in
"extensions first.".format(module))
ImportError: C extension: No module named ctypes not built. If you want to import pandas from the source directory, you may need to run 'python setup.py build_ext --inplace' to build the C extensions first.

I tried to fix it but I can't install ctypes and upgrading numpy doesn't change anything.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...