Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Why is the python SDK throwing Bad Gateway errors ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am running Splunk 6.2.1 on Windows 2008 and just installed the Python SDK. It took a while to get it configured but now when I run a script through the browser I get results, that is until I try the Splunk examples. Then I get 502.2 status codes.
For example when running a.py I get the following:
HTTP Error 502.2 - Bad Gateway
The specified CGI application misbehaved by not returning a complete set of HTTP headers. The headers it did return are "Traceback (most recent call last): File "C:\inetpub\wwwroot\splunk-sdk-python-master\examples\abc\a.py", line 43, in <module> raise Exception, "%d (%s)" % (response.status, response.reason) Exception: 401(Unauthorized) ".
I have verified .splunkrc, my environment variables, path etc.
I have no idea what is happening or why I cannot run any of the Splunk examples. My goal is to dispatch searches and get back the results without having the user log into Splunk. We are doing this now with PHP and Java, but would really like to move to Python.
Can anyone give me advice?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I’m going to try to answer my own question. It looks like a lot of the problem has to do with formatting the python, particularly printing HTML. And where the script is located in relationship to the Splunk python libraries. Once I had the script in the correct folder and inserted properly quoted print statements the whole thing worked. By quoted print statements I mean things like this:
print "Content-Type:text\html\r\n\r\n"
print "<html>"
print "<head>"
print "<title>Splunk IIS Activity</title>"
print "</head>"
The real problem with this entire exercise is that I could find nowhere where there was a simple python script that ran a search and displayed the results. Typically I had to find a line here and a block of code there until I had the script scavenged together. But it does dispatch a search and displays the raw results. Now I have to figure out how to get the results formatted.
Here is the code for the script:
import sys, os, splunklib.results as results, splunklib.client as client, string
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", ".."))
from xml.etree import ElementTree
import splunklib.binding as binding
HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"
service = client.connect(
host=HOST,
port=PORT,
username=USERNAME,
password=PASSWORD)
service.login()
kwargs_normalsearch = {"exec_mode": "blocking"}
jobs = service.jobs
job = jobs.create("search index=iis sourcetype=iis earliest=-6h | table time, c_ip, cs_uri_stem", **kwargs_normalsearch)
print "Content-Type:text\html\r\n\r\n"
print "<html>"
print "<head>"
print "<title>Splunk IIS Activity</title>"
print "</head>"
print "<body>"
print "<h3>IIS Activity</h3>"
print "Job result count = "
print job["resultCount"]
for result in results.ResultsReader(job.results()):
print result
print " "
print " "
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I’m going to try to answer my own question. It looks like a lot of the problem has to do with formatting the python, particularly printing HTML. And where the script is located in relationship to the Splunk python libraries. Once I had the script in the correct folder and inserted properly quoted print statements the whole thing worked. By quoted print statements I mean things like this:
print "Content-Type:text\html\r\n\r\n"
print "<html>"
print "<head>"
print "<title>Splunk IIS Activity</title>"
print "</head>"
The real problem with this entire exercise is that I could find nowhere where there was a simple python script that ran a search and displayed the results. Typically I had to find a line here and a block of code there until I had the script scavenged together. But it does dispatch a search and displays the raw results. Now I have to figure out how to get the results formatted.
Here is the code for the script:
import sys, os, splunklib.results as results, splunklib.client as client, string
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", ".."))
from xml.etree import ElementTree
import splunklib.binding as binding
HOST = "localhost"
PORT = 8089
USERNAME = "admin"
PASSWORD = "changeme"
service = client.connect(
host=HOST,
port=PORT,
username=USERNAME,
password=PASSWORD)
service.login()
kwargs_normalsearch = {"exec_mode": "blocking"}
jobs = service.jobs
job = jobs.create("search index=iis sourcetype=iis earliest=-6h | table time, c_ip, cs_uri_stem", **kwargs_normalsearch)
print "Content-Type:text\html\r\n\r\n"
print "<html>"
print "<head>"
print "<title>Splunk IIS Activity</title>"
print "</head>"
print "<body>"
print "<h3>IIS Activity</h3>"
print "Job result count = "
print job["resultCount"]
for result in results.ResultsReader(job.results()):
print result
print " "
print " "
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
