Developing for Splunk Enterprise

Python scripted lookup doesn't produce any results


Hi, I have created an scripted lookup (app) that looks up data in MongoDB and returns some results.

I have used an existing lookup (that works) as a template. When I test my lookup from the console with ~/bin/splunk cmd python < input.csv it works (just as the other script that I used as a base), however, when searching from splunk it returns no result:


[ui] is_visible = false label = MongoLookup


[mlookup] external_cmd = fields_list = clientuid country cref refid

Searching with: index="idx_XXXXXX" sourcetype="YYYYYYY" | lookup mlookup clientuid as userID | table userID, country

I get no results for country,cref,refid

Is there a way I could see what's splunk doing when calling my script?

Splunk Employee
Splunk Employee

The error output of scripted inputs is indexed by Splunk in the _internal index. You can search the errors with a similar search to the following:

index="_internal" error

You should see notices that look like "ERROR ExecProcessor", followed by the script path/name.

This data is also kept in $SPLUNK_HOME/var/log/splunk in splunkd.log.