Developing for Splunk Enterprise

Python SDK file upload issue

Explorer

I'm testing uploading a file using the Splunk Python SDK and receiving the following error :
Traceback (most recent call last):
File "testConnection.py", line 50, in
myindex.upload("/opt/splunkforwarder/bin/scripts/test");
File "/home/hafahmed/splunk-sdk-python-1.6.6/splunklib/client.py", line 2106, in upload
self.service.post(path, name=filename, **kwargs)
File "/home/hafahmed/splunk-sdk-python-1.6.6/splunklib/binding.py", line 289, in wrapper
return request_fun(self, *args, **kwargs)
File "/home/hafahmed/splunk-sdk-python-1.6.6/splunklib/binding.py", line 71, in new_f
val = f(*args, **kwargs)
File "/home/hafahmed/splunk-sdk-python-1.6.6/splunklib/binding.py", line 752, in post
response = self.http.post(path, all_headers, **query)
File "/home/hafahmed/splunk-sdk-python-1.6.6/splunklib/binding.py", line 1224, in post
return self.request(url, message)
File "/home/hafahmed/splunk-sdk-python-1.6.6/splunklib/binding.py", line 1244, in request
raise HTTPError(response)
splunklib.binding.HTTPError: HTTP 400 Bad Request -- unable to open file: path='/opt/splunkforwarder/bin/scripts/test' error='No such file or directory'

Code snippet:
myindex = service.indexes["testing"]

myindex.upload("/opt/splunkforwarder/bin/scripts/test");

The file exists and has the correct permissions, Any hints?

Labels (2)
Tags (2)

Path Finder

I think the problem might be where the file is located, if the file is in another server it won't work. In other words, you first need to copy the file to Splunk SH server then you can upload it. Once the file is locally you can pass the path and call the function to upload the file.

SCP the file to /tmp folder then:

myindex = service.indexes["secdevops"]

uploadme = "/tmp/scoring_output.csv"

myindex.upload(uploadme);

0 Karma

Path Finder

unable to open file it's like permission problem ?

chmod a+x yourscript.py Or yourscrpit.sh

can you try ?

0 Karma

Motivator

Your file does not have an extension. Splunk interprets files with no extension as binary files and will not ingest them.

0 Karma

Explorer

hmm tried changing the extension but I'm still getting the same error

splunklib.binding.HTTPError: HTTP 400 Bad Request -- unable to open file: path='/opt/splunkforwarder/bin/scripts/test.txt' error='No such file or directory'

0 Karma

Can you post the actual lines of python code for the upload?

0 Karma

Explorer

myindex = service.indexes["testing"]
uploadme = "/opt/splunkforwarder/bin/scripts/test.txt"
myindex.upload(uploadme)

0 Karma

This method does not use a path, it just uses a file name as parameter. Try to change the directory,and then try to use just "text.txt" as the parameter for the upload function. You can change the directory in python with os.chdir see example here: https://stackoverflow.com/questions/431684/how-do-i-change-directory-cd-in-python

Currently, you tried to upload a file that is called "opt/Splunk...." in your current working directory, that's why the file is not found.

0 Karma

Motivator

Is the file and directory owned by splunk?

0 Karma

Hi,

is there no file extention like test.sh or test.py? Looks like your path is pointing to a folder, not a file.
Which permissions does the file have? Is it readable and executable?

0 Karma

Explorer

it's actually pointing to a file and it's both readable and executable 😞

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!