Help in import of Numpy in Splunk

[ygkr]

I wrote a python script where it is using numpy, while running my script in splunk it is not able to import numpy from splunk.
Kindly help me how to install numpy package in splunk to run my python script from splunk search.

Below are the errors m getting while calling my script from search bar:

12-29-2016 12:12:54.240 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\single_phase.py 100 10 200': Traceback (most recent call last):
12-29-2016 12:12:54.240 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\single_phase.py 100 10 200': File "C:\Program Files\Splunk\etc\apps\search\bin\single_phase.py", line 8, in
12-29-2016 12:12:54.240 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\single_phase.py 100 10 200': import numpy as np
12-29-2016 12:12:54.240 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\single_phase.py 100 10 200': File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\numpy_init.py", line 180, in
12-29-2016 12:12:54.240 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\single_phase.py 100 10 200': from . import add_newdocs
12-29-2016 12:12:54.240 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\single_phase.py 100 10 200': File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\numpy\add_newdocs.py", line 13, in
12-29-2016 12:12:54.240 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\single_phase.py 100 10 200': from numpy.lib import add_newdoc
12-29-2016 12:12:54.240 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\single_phase.py 100 10 200': File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\numpy\lib__init.py", line 8, in
12-29-2016 12:12:54.240 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\single_phase.py 100 10 200': from .type_check import *
12-29-2016 12:12:54.240 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\single_phase.py 100 10 200': File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\numpy\lib\type_check.py", line 11, in
12-29-2016 12:12:54.240 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\single_phase.py 100 10 200': import numpy.core.numeric as _nx
12-29-2016 12:12:54.240 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\single_phase.py 100 10 200': File "C:\Program Files\Splunk\Python-2.7\Lib\site-packages\numpy\core__init_.py", line 14, in
12-29-2016 12:12:54.240 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\single_phase.py 100 10 200': from . import multiarray
12-29-2016 12:12:54.240 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\single_phase.py 100 10 200': ImportError: DLL load failed: A dynamic link library (DLL) initialization routine failed.
12-29-2016 12:12:54.272 ERROR script - sid:1482993773.3 External search command 'pyt' returned error code 1.

[adambloom · Accepted solution]

Also check out the "Python for Scientific Computing" app - note that you need to install it for the correct OS. Here's the link to the 64-bit linux version: https://splunkbase.splunk.com/app/2882/. It includes numpy, sklearn, pandas, etc. You can use it in your scripts without too much additional effort - just take a look at the readme in the app for instructions.

[ygkr]

I tried this way!! there also m getting the same error.. @adambloom

[adambloom]

You used the Windows version? The correct link is https://splunkbase.splunk.com/app/2883/. The error you're getting is related to loading one of the C libraries used by numpy, which suggests an OS compatibility issue.

[ygkr]

its working nw thanks a lot @adambloom 🙂

[bmacias84]

Numpy is not included in Splunk internal python, but you can either call an external python with numpy or build an egg which includes numpy. I've built a numpy egg for use in Splunk and is my preferred method. To build numpy you will need to build the egg on an external system with the same version of python as Splunk with all dependancies.

https://answers.splunk.com/answers/8/can-i-add-python-modules-to-the-splunk-environment.html

https://answers.splunk.com/answers/220196/import-non-native-python-libraries-into-splunk.html#answer...