Splunk Search

How to fix "no module named splunklib" error for python splunk sdk on Windows?

rockzers
Path Finder

reated splunk python script and set splunk web on "data input" and added all procedures

but my script is not running in splunk web and i installed python splunk sdk on windows using this command

pip install splunk-sdk

I've run my code in this folder and verified that it works

C:\Program Files\Splunk\etc\apps\search\bin\python sample.py

but it doesn't work in Splunk Web.
How to solve this problem on Windows? Do I need to change any in the Splunk folder path?

C:\Program Files\Splunk\etc\apps\search\bin\sample.py

any solution solve this problem in splunk windows?

Labels (1)
Tags (4)
0 Karma
1 Solution

rockzers
Path Finder

I tried to move the splunklib folder from splunk-sdk-python-master to the bin folder and delete the splunk-sdk-python-master folder
it's working now

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You should test your Python script in the Splunk run-time environment before trying to run it in splunkweb.

splunk cmd python sample.py

Before we can tell you how to solve the problem we first have to know what the problem is.  "It doesn't work" is not a problem description.  What results do you get and how do those results not meet expectations?  What error message(s) do you get?  Have you checked python.log?

---
If this reply helps you, Karma would be appreciated.
0 Karma

rockzers
Path Finder

Hi @richgalloway 

when i run the command i get an error like this

splunk cmd python sample.py


C:\Program Files\Splunk\etc\apps\search\bin>splunk cmd python sample.py
'splunk' is not recognized as an internal or external command,
operable program or batch file.

I checked the log using this command

index="_internal" ExecProcessor sourcetype="splunkd" ERROR

shows this error

08-19-2022 23:22:05.955 +0900 ERROR ExecProcessor [3612 ExecProcessor] - message from “”C:\Program Files\Splunk\bin\Python3.exe” “C:\Program Files\Splunk\etc\apps\search\bin\sample.py”" ModuleNotFoundError: No module named ‘splunklib’

08-19-2022 23:22:05.955 +0900 ERROR ExecProcessor [3612 ExecProcessor] - message from ""C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\search\bin\sample.py"" import splunklib.client as client
host =WIN-L!Bsource = C:\Program Files\Splunk\var\log\splunk\splunkd.logsourcetype = splunkd

08-19-2022 23:22:05.955 +0900 ERROR ExecProcessor [3612 ExecProcessor] - message from ""C:\Program Files\Splunk\bin\Python3.exe" "C:\Program Files\Splunk\etc\apps\search\bin\sample.py"" Traceback (most recent call last):
host = WIN-L!Bsource = C:\Program Files\Splunk\var\log\splunk\splunkd.logsourcetype = splunkd


0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sorry.  On Windows machines, the command is

splunk.exe cmd python sample.py

The log appears to have identified the problem.

ModuleNotFoundError: No module named ‘splunklib’

Did you include splunklib in your app?

---
If this reply helps you, Karma would be appreciated.
0 Karma

rockzers
Path Finder

I tried to move the splunklib folder from splunk-sdk-python-master to the bin folder and delete the splunk-sdk-python-master folder
it's working now

Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...