Installation

Getting error 'No module named Crypto.Cipher' in Python script

santosh_sshanbh
Path Finder

I have created a custom alert action which calls a Python script. The script uses Crypto.Cipher library to encrypt/decrypt sting data.

When I run the script from Spyder IDE, it works fine and returns expected result. However, when the same script runs from Splunk it gives below error

03-26-2019 13:06:02.949 +0000 ERROR sendmodalert - action=test STDERR - Traceback (most recent call last):
03-26-2019 13:06:02.949 +0000 ERROR sendmodalert - action=test STDERR - File "F:\Program Files\Splunk\etc\apps\alert_test\bin\test.py", line 5, in
03-26-2019 13:06:02.949 +0000 ERROR sendmodalert - action=test STDERR - from Crypto.Cipher import AES
03-26-2019 13:06:02.949 +0000 ERROR sendmodalert - action=test STDERR - ImportError: No module named Crypto.Cipher
03-26-2019 13:06:03.205 +0000 INFO sendmodalert - action=test - Alert action script completed in duration=778 ms with exit code=1
03-26-2019 13:06:03.205 +0000 WARN sendmodalert - action=test - Alert action script returned error code=1

I have below code in the python script

from Crypto.Cipher import AES
import base64

Tags (1)
0 Karma

nickhills
Ultra Champion

Splunk has its own Python executable and libraries.
If you are using custom libs you need to copy these into your application's /bin directory so the Splunk Python can load them

If my comment helps, please give it a thumbs up!
0 Karma

santosh_sshanbh
Path Finder

I am using pycrypto library which can be downloaded from https://www.dlitz.net/software/pycrypto/

However, the download contains multiple files, directories. Do I need to keep all of them in my custom apps bin directory?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...