I know this is probably because I am not a Python expert and I have done something wrong, but when I try to run your Python Example of how to create a search (http://www.splunk.com/base/Documentation/latest/Developer/RESTCreateSearch), I get this:
[root@splunk ~]# python test.py
/opt/splunk/lib/python2.6/site-packages/httplib2/__init__.py:47: DeprecationWarning: the sha module is deprecated; use the hashlib module instead
import sha
Traceback (most recent call last):
File "test.py", line 4, in
import httplib2
File "/opt/splunk/lib/python2.6/site-packages/httplib2/__init__.py", line 47, in
import sha
File "/opt/splunk/lib/python2.6/sha.py", line 10, in
from hashlib import sha1 as sha
File "/opt/splunk/lib/python2.6/hashlib.py", line 136, in
md5 = __get_builtin_constructor('md5')
File "/opt/splunk/lib/python2.6/hashlib.py", line 63, in __get_builtin_constructor
import _md5
ImportError: No module named _md5
What am I doing wrong?
You need to set the Splunk environment first. The easiest way is to invoke python using $SPLUNK_HOME/bin/splunk cmd python test.py. You could also do (in bash or sh) source $SPLUNK_HOME/bin/setSplunkEnv, then call python test.py.
FYI, a similar problem on the Windows platform required running a script C:\Program Files\Splunk\etc\apps\TA-uas_parser\bin\update_cache.py as:
%SPLUNK_HOME%\bin\splunk cmd python update_cache.py
or
"%SPLUNK_HOME%"\bin\splunk cmd python update_cache.py
Depending on how you have quoted your splunk_home path.
You need to set the Splunk environment first. The easiest way is to invoke python using $SPLUNK_HOME/bin/splunk cmd python test.py. You could also do (in bash or sh) source $SPLUNK_HOME/bin/setSplunkEnv, then call python test.py.