Splunk Search

Python example fails

rmarshall
Explorer

I know this is probably because I am not a Python expert and I have done something wrong, but when I try to run your Python Example of how to create a search (http://www.splunk.com/base/Documentation/latest/Developer/RESTCreateSearch), I get this:

[root@splunk ~]# python test.py

/opt/splunk/lib/python2.6/site-packages/httplib2/__init__.py:47: DeprecationWarning: the sha module is deprecated; use the hashlib module instead
  import sha
Traceback (most recent call last):
  File "test.py", line 4, in 
    import httplib2
  File "/opt/splunk/lib/python2.6/site-packages/httplib2/__init__.py", line 47, in 
    import sha
  File "/opt/splunk/lib/python2.6/sha.py", line 10, in 
    from hashlib import sha1 as sha
  File "/opt/splunk/lib/python2.6/hashlib.py", line 136, in 
    md5 = __get_builtin_constructor('md5')
  File "/opt/splunk/lib/python2.6/hashlib.py", line 63, in __get_builtin_constructor
    import _md5
ImportError: No module named _md5

What am I doing wrong?

Tags (3)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You need to set the Splunk environment first. The easiest way is to invoke python using $SPLUNK_HOME/bin/splunk cmd python test.py. You could also do (in bash or sh) source $SPLUNK_HOME/bin/setSplunkEnv, then call python test.py.

View solution in original post

Richfez
SplunkTrust
SplunkTrust

FYI, a similar problem on the Windows platform required running a script C:\Program Files\Splunk\etc\apps\TA-uas_parser\bin\update_cache.py as:

%SPLUNK_HOME%\bin\splunk cmd python update_cache.py

or

"%SPLUNK_HOME%"\bin\splunk cmd python update_cache.py

Depending on how you have quoted your splunk_home path.

gkanapathy
Splunk Employee
Splunk Employee

You need to set the Splunk environment first. The easiest way is to invoke python using $SPLUNK_HOME/bin/splunk cmd python test.py. You could also do (in bash or sh) source $SPLUNK_HOME/bin/setSplunkEnv, then call python test.py.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...