Splunk Search

Python example fails

rmarshall
Explorer

I know this is probably because I am not a Python expert and I have done something wrong, but when I try to run your Python Example of how to create a search (http://www.splunk.com/base/Documentation/latest/Developer/RESTCreateSearch), I get this:

[root@splunk ~]# python test.py

/opt/splunk/lib/python2.6/site-packages/httplib2/__init__.py:47: DeprecationWarning: the sha module is deprecated; use the hashlib module instead
  import sha
Traceback (most recent call last):
  File "test.py", line 4, in 
    import httplib2
  File "/opt/splunk/lib/python2.6/site-packages/httplib2/__init__.py", line 47, in 
    import sha
  File "/opt/splunk/lib/python2.6/sha.py", line 10, in 
    from hashlib import sha1 as sha
  File "/opt/splunk/lib/python2.6/hashlib.py", line 136, in 
    md5 = __get_builtin_constructor('md5')
  File "/opt/splunk/lib/python2.6/hashlib.py", line 63, in __get_builtin_constructor
    import _md5
ImportError: No module named _md5

What am I doing wrong?

Tags (3)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You need to set the Splunk environment first. The easiest way is to invoke python using $SPLUNK_HOME/bin/splunk cmd python test.py. You could also do (in bash or sh) source $SPLUNK_HOME/bin/setSplunkEnv, then call python test.py.

View solution in original post

Richfez
SplunkTrust
SplunkTrust

FYI, a similar problem on the Windows platform required running a script C:\Program Files\Splunk\etc\apps\TA-uas_parser\bin\update_cache.py as:

%SPLUNK_HOME%\bin\splunk cmd python update_cache.py

or

"%SPLUNK_HOME%"\bin\splunk cmd python update_cache.py

Depending on how you have quoted your splunk_home path.

gkanapathy
Splunk Employee
Splunk Employee

You need to set the Splunk environment first. The easiest way is to invoke python using $SPLUNK_HOME/bin/splunk cmd python test.py. You could also do (in bash or sh) source $SPLUNK_HOME/bin/setSplunkEnv, then call python test.py.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...