Splunk Dev

External search command 'mypythonfile' returned error code 1 after Splunk upgrade

harshal_chakran
Builder

Hi,
I am trying to run a python file in search command.

|script python mypythonfile

I was able to run it the Splunkversion 6.0 before. But when I shifed to 6.1, I am getting the following error while running the command:

External search command 'mypythonfile' returned error code 1.

I made the changes in commands.conf too.

[mypythonfile]
filename= mypythonfile.py

Following is my mypythonfile.py file:

from pprint import pprint
import socket
import sys
import os
import time
import csv
import glob
import unicodedata
import Constants
import shutil
import splunklib.client as client
import splunklib.results as results
from xml.dom import minidom
from utils import error, parse
from time import sleep
from array import array
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", ".."))
import SplunkMethods
import ParsingAndFilteredCSV
import Utilities
import BSC
import Cell
import Network
import WeakPerforming
import threading
from splunklib.modularinput import *
from sys import exit
try:
import xml.etree.cElementTree as ET
except ImportError:
import xml.etree.ElementTree as ET
def main(): ####MY CODE######
try:
except:
import traceback
stack = traceback.format_exc()
results = splunk.Intersplunk.generateErrorResults("Error : Traceback: " + str(stack))
if __name__ == "__main__":
main()

Kindly Help...!!!

Tags (3)
0 Karma

praveenkpatidar
Explorer

Hello Harshal,

It seems the indentation is not correct in the python. To get this correct use below URL to check for Indent related errors. Package related errors are fine.
Once you resolve indent related errors, then you can use the file for custom commands.

https://www.tutorialspoint.com/execute_python_online.php

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...