Developing for Splunk Enterprise

Use Python to upload file into Splunk

ericchaucl
Path Finder

I follow the instructions in here http://dev.splunk.com/view/python-sdk/SP-CAAAEE6 and just want to upload 1 single file into Splunk using Python with codes like this:

myindex = service.indexes["test_index"]
uploadme = "test.csv"
myindex.upload(uploadme);

I simply put the test.csv file together with the source code. However, it always show the error:
splunklib.binding.HTTPError: HTTP 400 Bad Request -- unable to open file: path='test.csv' error='The system cannot find the file specified.'

I've also tried to specify the whole path like this but also gives the same error:
uploadme = "c:/test/test.csv"

How should I specify the filename (in Windows)? Or where should I put the file?

P.S. I've already built the Splunk connection in Python and can run search properly.

0 Karma
1 Solution

mumblingsages
Path Finder

Are you trying to upload the file to a remote server? If so, the default service configuration for Splunk is such that it cannot reference files that are not stored locally. In such a case the file path you are specifying must be local to the server itself.

View solution in original post

ericchaucl
Path Finder

Busy in working on something else and have put down this issue for a long time .....

This approach could work for my case to build a prototype only.

0 Karma

ericchaucl
Path Finder

Busy in working on something else and have put down this issue for a long time .....

This approach could work for my case to build a prototype only.

0 Karma

woodcock
Esteemed Legend

Why bother with any code at all? Splunk already has a CLI for this called add oneshot:
http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorfilesanddirectoriesusingtheCLI

0 Karma

ericchaucl
Path Finder

I'm writing a Python program to analyze some external raw data and want to export the results into Splunk for further handling/reporting. Would be perfect if I can control the whole workflow in Python directly.

Thanks for the advise and may have a try on that.

tolaram
New Member

Did this work for you ?

0 Karma

mumblingsages
Path Finder

Are you trying to upload the file to a remote server? If so, the default service configuration for Splunk is such that it cannot reference files that are not stored locally. In such a case the file path you are specifying must be local to the server itself.

View solution in original post

ericchaucl
Path Finder

Thanks! If the default service Splunk configuration cannot reference files that are not stored locally, can I update the configuration to allow this?

0 Karma

mumblingsages
Path Finder

I believe there is but I haven't had time to fully investigate that as part of my development. Instead, I've created network share on the remote host that my python script has access too (and nothing else) and it copies it's to there. Then in my upload call via python I specify the local path (not the share name) on the remote host.

0 Karma

ericchaucl
Path Finder

Good idea and it works. Thanks!

0 Karma