Splunk Dev

Why is the Python script input data show no result in search?

csimonnet
New Member

Hello,
I have a python scripted input which doesn't return any result in the search and I don't understand why because I can run my script in the terminal computer with the user splunk:

splunk@splunk1:~/etc/apps/bike_sharing/bin$ python NYC_predict_bike.py

extract of the result:

[{"FCTTIME":1524250800000,"conds":"Clear","dewptm":"-5","fctcode":1,"feelslike":"5","heatindex":"-9999","hum":39,"icon":"clear","mslp":"1023","pop":0,"qpf":"0","sky":11,"snow":"0","tempm":"8","uvi":0,"wdir":"NW","windchill":"5","wspd":"19","TZ":7200000,"dock_id":"3681","capacity":0,"eightd_has_key_dispenser":false,"eightd_station_services":null,"lat":40.7151776773,"lon":-74.0376833081,"name":"Grand St","region_id":null,"rental_methods":["KEY","CREDITCARD"],"short_name":"JC102"}]

0 Karma

niketn
Legend

@csimonnet, to debug can you please try the following link to write error logs to Splunk's _internal index using sys.stderror.write to ensure that Script is executing?

https://sublimerobots.com/2017/01/simple-splunk-scripted-input-example/

sys.stderr.write("Python script is starting up\n") 

Refer to a recent answer, have you scheduled your Python scripted input in Splunk? https://answers.splunk.com/answers/628853/how-to-add-scripts-as-data-input.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

csimonnet
New Member

Thanks,
now I can see a new error:
import pandas as pd
File "/opt/splunk/etc/apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/lib/python2.7/site-packages/pandas/__init__.py", line 13, in
"extensions first.".format(module))
ImportError: C extension: No module named ctypes not built. If you want to import pandas from the source directory, you may need to run 'python setup.py build_ext --inplace' to build the C extensions first.

I tried to fix it but I can't install ctypes and upgrading numpy doesn't change anything.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...