Splunk Dev

How do I add a python module for external lookup command?

ndoshi
Splunk Employee
Splunk Employee

I know the answers site has a description for having one Python program call another, which includes a custom module, but this seems to be more geared for scripted inputs or alerts. http://splunk-base.splunk.com/answers/8/can-i-add-python-modules-to-the-splunk-environment. I have a custom module that works outside of Splunk in Python 2.6, but I need to use this within a lookup Python script. The script will have parameters passed within it as labeled in transforms.conf. The custom module will eventually call native C/C++ code. The module builds itself into an egg file. I can't simply drop this file into Splunk's Python 2.6 site-packages directory as even the import didn't work. How do I let Splunk know about this module so that the lookup Python script can import and use it?

Tags (3)
1 Solution

BryantD
Explorer

Try using a wrapper script. The one described in the answer you link to is possibly more complex than what's needed for lookups. I solved this problem yesterday using a wrapper, as follows.

wrapper.py:

import os

NEW_PYTHON_PATH = '/usr/bin/python'

os.environ['PYTHONPATH'] = NEW_PYTHON_PATH
my_process = '/opt/splunk/etc/apps/zgp/bin/lookup.py')

os.execv(my_process, ())

View solution in original post

0 Karma

rosslord
Engager

As an aside, I was able to call a script with this:

#!/bin/bash
/usr/bin/python /path/to/python/script.py

.. andit found all my moduldes and worked fine.

ndoshi
Splunk Employee
Splunk Employee

My original question was for lookup scripts as lookups call Python directly and do not call shell scripts.

0 Karma

BryantD
Explorer

Try using a wrapper script. The one described in the answer you link to is possibly more complex than what's needed for lookups. I solved this problem yesterday using a wrapper, as follows.

wrapper.py:

import os

NEW_PYTHON_PATH = '/usr/bin/python'

os.environ['PYTHONPATH'] = NEW_PYTHON_PATH
my_process = '/opt/splunk/etc/apps/zgp/bin/lookup.py')

os.execv(my_process, ())
0 Karma

ndoshi
Splunk Employee
Splunk Employee

Thanks for your reply. I think the the field header arguments would have to be put in the myprocess = ... part. Lowell provided an even easier answer in a past post for my module that happens to be in an egg: Lowell wrote "Instead I recommend creating .egg files, putting them in your own lib folder, and explicitly doing a sys.path.append("/your/lib/whatever.egg") before your import."

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...