External lookup failing with error code 1 - 6.1.2

[hortonew]

I'm trying to get an external lookup to work (already have one other one working successfully), but I've been getting the following error:

Script for lookup table 'myTestLookup' returned error code 1. Results may be incorrect.

Calling the script manually works. The details are below. Any thoughts?

Splunk Search

index=* | head 1 | eval jobname="Test" | eval status="FAILURE" | lookup myTestLookup jobname status OUTPUT recipients | table jobname, status, recipients

transforms.conf

[myTestLookup]
external_cmd = myTestLookup.py jobname status recipients
external_type = python
fields_list = jobname, status, recipients

/tmp/Splunk/test.csv

jobname,status,recipients
"test","test",

command

splunk cmd python myTestLookup.py "test" "test" "" < /tmp/Splunk/test.csv

successful output

jobname,status,recipients
test,test,"test@test.com"

[hortonew · Accepted solution]

While waiting for this to post, I tried adding an absolute path in the script and it worked. Not sure where Splunk runs scripts from, but it's not the bin directory in the app.

[MuS]

Ho hortonew,

I agree the path could be a problem. Add some debugging to your script like this:

#myDebug="no" # debug disabled
myDebug="yes" # debug enabled

# get SPLUNK_HOME form OS
SPLUNK_HOME = os.environ['SPLUNK_HOME']

# get myScript name and path
myScript = os.path.basename(__file__)
myPath = os.path.dirname(os.path.realpath(__file__))

# define the logger to write into log file
def setup_logging(n):
    logger = logging.getLogger(n)
    if myDebug == "yes":
        logger.setLevel(logging.DEBUG)
    else:
        logger.setLevel(logging.ERROR)
    LOGGING_DEFAULT_CONFIG_FILE = os.path.join(SPLUNK_HOME, 'etc', 'log.cfg')
    LOGGING_LOCAL_CONFIG_FILE = os.path.join(SPLUNK_HOME, 'etc', 'log-local.cfg')
    LOGGING_STANZA_NAME = 'python'
    LOGGING_FILE_NAME = "%s.log" % myScript
    BASE_LOG_PATH = os.path.join('var', 'log', 'splunk')
    LOGGING_FORMAT = "%(asctime)s %(levelname)-s\t%(module)s:%(lineno)d - %(message)s"
    splunk_log_handler = logging.handlers.RotatingFileHandler(os.path.join(SPLUNK_HOME, BASE_LOG_PATH, LOGGING_FILE_NAME), mode='a')
    splunk_log_handler.setFormatter(logging.Formatter(LOGGING_FORMAT))
    logger.addHandler(splunk_log_handler)
    splunk.setupSplunkLogger(logger, LOGGING_DEFAULT_CONFIG_FILE, LOGGING_LOCAL_CONFIG_FILE, LOGGING_STANZA_NAME)
    return logger

# start the logger for troubleshooting
if myDebug == "yes": logger = setup_logging( "Logger started ..." ) # logger

This will produce a logfile for your script in $SPLUNK_HOME/var/log/splunk/

Hope this helps ...

cheers, MuS

[hortonew]

The only thing I can think of is in my script I'm opening a file with a relative path. Will that path not work when called by Splunk? For example:

with open("../lookups/test.csv", "rb") as infile:
etc...