Splunk Dev

External search command 'mypythonfile' returned error code 1 after Splunk upgrade

harshal_chakran
Builder

Hi,
I am trying to run a python file in search command.

|script python mypythonfile

I was able to run it the Splunkversion 6.0 before. But when I shifed to 6.1, I am getting the following error while running the command:

External search command 'mypythonfile' returned error code 1.

I made the changes in commands.conf too.

[mypythonfile]
filename= mypythonfile.py

Following is my mypythonfile.py file:

from pprint import pprint
import socket
import sys
import os
import time
import csv
import glob
import unicodedata
import Constants
import shutil
import splunklib.client as client
import splunklib.results as results
from xml.dom import minidom
from utils import error, parse
from time import sleep
from array import array
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", ".."))
import SplunkMethods
import ParsingAndFilteredCSV
import Utilities
import BSC
import Cell
import Network
import WeakPerforming
import threading
from splunklib.modularinput import *
from sys import exit
try:
import xml.etree.cElementTree as ET
except ImportError:
import xml.etree.ElementTree as ET
def main(): ####MY CODE######
try:
except:
import traceback
stack = traceback.format_exc()
results = splunk.Intersplunk.generateErrorResults("Error : Traceback: " + str(stack))
if __name__ == "__main__":
main()

Kindly Help...!!!

Tags (3)
0 Karma

praveenkpatidar
Explorer

Hello Harshal,

It seems the indentation is not correct in the python. To get this correct use below URL to check for Indent related errors. Package related errors are fine.
Once you resolve indent related errors, then you can use the file for custom commands.

https://www.tutorialspoint.com/execute_python_online.php

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Unlocking Data-In-Place Search Across Splunk and Snowflake  Enterprise data is increasingly distributed across ...

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

If you’ve spent any time in the Splunk Community Slack, you’ve likely seen our resident Splunk Trust ...

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Navigating the show floor at .conf26 isn't just about keynotes and technical breakout sessions; it's also ...