Not able to use oneshot method to execute splunk query to fetch data from inputlookup

[shreyans]

Hi,

I have a requirement of fetching data from static lookup within python code
i.e Query would be
| inputlookup xyz | fields f1,f2,f3

and thus using service.jobs.oneshot method as per python sdk

As soon as I use
job = service.jobs.oneshot("| inputlookup xyz | fields f1,f2,f3",**kwargs_oneshot)
it returns no results.

same splunk query works fine in normal search query windows (So nothing wrong with query as such) and same python code works fine if i use normal search query like
job = service.jobs.oneshot("search index=idx1 | fields f1,f2,f3",**kwargs_oneshot)

adding to that i found that if i remove search keyword from splunk search it returns no result, below query returns no result
job = service.jobs.oneshot("index=idx1 | fields f1,f2,f3",**kwargs_oneshot)

With this i feel there should be some specified search format which we should use in our inputlookup query within oneshot metho

Do anyone have any input about how to write inputlookup query in oneshot method

[twesthead]

Hi, I had the same problem as OP and @jkat54's answer helped me a lot.
My lookup was defined for a specific app and I wasn't specifying the app when connecting to splunklib.client.
Therefore, in the following code: job1 returns no results and job2 returns what I expected.

service1 = splunklib.client.connect(username="grinch", password="who")
job1 = service1.jobs.oneshot("| inputlookup whoville_addresses")

service2 = splunklib.client.connect(username="grinch", password="who", app="steal_xmas")
job2 = service2.jobs.oneshot("| inputlookup whoville_addresses")

[jkat54]

Cool yeah I remember working with you in slack chat to figure this out. And hey, now you've got the answer I didn't have when I wrote the answer here. So I'm converting your comment on my answer to the actual answer for this question! Great work @twesthead

[twesthead]

Hmm, I believe it wasn't me on slack. But still, thanks for your help with this!

[jkat54]

Wow, so it was kathyc i was working with just last week on this issue. Hopefully the next person will find this post and solve the problem using your solution!

[jkat54]

I'm assuming the lookup "doesnt exists" for one of the following reasons:

User you're using with oneshot doesnt have read access to lookup (splunk permissions fix)
Lookup.csv is owned by someone other than the user that is running splunkd (linux permissions / chown to fix)
Lookup.csv is not on the server you're querying

Also you should enable_lookups on your oneshot:

There's a good explanation here under "GET search/jobs/export"... search the page for enable_lookups. Sometimes it defaults to true, but not always... and maybe they've changed it to default to false, etc.

http://dev.splunk.com/view/java-sdk/SP-CAAAEHQ