I have a requirement of fetching data from static lookup within python code
i.e Query would be
| inputlookup xyz | fields f1,f2,f3
and thus using service.jobs.oneshot method as per python sdk
As soon as I use
job = service.jobs.oneshot("| inputlookup xyz | fields f1,f2,f3",**kwargs_oneshot)
it returns no results.
same splunk query works fine in normal search query windows (So nothing wrong with query as such) and same python code works fine if i use normal search query like
job = service.jobs.oneshot("search index=idx1 | fields f1,f2,f3",**kwargs_oneshot)
adding to that i found that if i remove search keyword from splunk search it returns no result, below query returns no result
job = service.jobs.oneshot("index=idx1 | fields f1,f2,f3",**kwargs_oneshot)
With this i feel there should be some specified search format which we should use in our inputlookup query within oneshot metho
Do anyone have any input about how to write inputlookup query in oneshot method
I'm assuming the lookup "doesnt exists" for one of the following reasons:
User you're using with oneshot doesnt have read access to lookup (splunk permissions fix)
Lookup.csv is owned by someone other than the user that is running splunkd (linux permissions / chown to fix)
Lookup.csv is not on the server you're querying
Also you should enable_lookups on your oneshot:
There's a good explanation here under "GET search/jobs/export"... search the page for enable_lookups. Sometimes it defaults to true, but not always... and maybe they've changed it to default to false, etc.
Hi, I had the same problem as OP and @jkat54's answer helped me a lot.
My lookup was defined for a specific app and I wasn't specifying the app when connecting to
Therefore, in the following code:
job1 returns no results and
job2 returns what I expected.
service1 = splunklib.client.connect(username="grinch", password="who") job1 = service1.jobs.oneshot("| inputlookup whoville_addresses") service2 = splunklib.client.connect(username="grinch", password="who", app="steal_xmas") job2 = service2.jobs.oneshot("| inputlookup whoville_addresses")
Cool yeah I remember working with you in slack chat to figure this out. And hey, now you've got the answer I didn't have when I wrote the answer here. So I'm converting your comment on my answer to the actual answer for this question! Great work @twesthead
Wow, so it was kathyc i was working with just last week on this issue. Hopefully the next person will find this post and solve the problem using your solution!