Installation

Getting error 'No module named Crypto.Cipher' in Python script

santosh_sshanbh
Path Finder

I have created a custom alert action which calls a Python script. The script uses Crypto.Cipher library to encrypt/decrypt sting data.

When I run the script from Spyder IDE, it works fine and returns expected result. However, when the same script runs from Splunk it gives below error

03-26-2019 13:06:02.949 +0000 ERROR sendmodalert - action=test STDERR - Traceback (most recent call last):
03-26-2019 13:06:02.949 +0000 ERROR sendmodalert - action=test STDERR - File "F:\Program Files\Splunk\etc\apps\alert_test\bin\test.py", line 5, in
03-26-2019 13:06:02.949 +0000 ERROR sendmodalert - action=test STDERR - from Crypto.Cipher import AES
03-26-2019 13:06:02.949 +0000 ERROR sendmodalert - action=test STDERR - ImportError: No module named Crypto.Cipher
03-26-2019 13:06:03.205 +0000 INFO sendmodalert - action=test - Alert action script completed in duration=778 ms with exit code=1
03-26-2019 13:06:03.205 +0000 WARN sendmodalert - action=test - Alert action script returned error code=1

I have below code in the python script

from Crypto.Cipher import AES
import base64

Tags (1)
0 Karma

nickhills
Ultra Champion

Splunk has its own Python executable and libraries.
If you are using custom libs you need to copy these into your application's /bin directory so the Splunk Python can load them

If my comment helps, please give it a thumbs up!
0 Karma

santosh_sshanbh
Path Finder

I am using pycrypto library which can be downloaded from https://www.dlitz.net/software/pycrypto/

However, the download contains multiple files, directories. Do I need to keep all of them in my custom apps bin directory?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...