Splunk Search

Python example fails

rmarshall
Explorer

I know this is probably because I am not a Python expert and I have done something wrong, but when I try to run your Python Example of how to create a search (http://www.splunk.com/base/Documentation/latest/Developer/RESTCreateSearch), I get this:

[root@splunk ~]# python test.py

/opt/splunk/lib/python2.6/site-packages/httplib2/__init__.py:47: DeprecationWarning: the sha module is deprecated; use the hashlib module instead
  import sha
Traceback (most recent call last):
  File "test.py", line 4, in 
    import httplib2
  File "/opt/splunk/lib/python2.6/site-packages/httplib2/__init__.py", line 47, in 
    import sha
  File "/opt/splunk/lib/python2.6/sha.py", line 10, in 
    from hashlib import sha1 as sha
  File "/opt/splunk/lib/python2.6/hashlib.py", line 136, in 
    md5 = __get_builtin_constructor('md5')
  File "/opt/splunk/lib/python2.6/hashlib.py", line 63, in __get_builtin_constructor
    import _md5
ImportError: No module named _md5

What am I doing wrong?

Tags (3)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You need to set the Splunk environment first. The easiest way is to invoke python using $SPLUNK_HOME/bin/splunk cmd python test.py. You could also do (in bash or sh) source $SPLUNK_HOME/bin/setSplunkEnv, then call python test.py.

View solution in original post

Richfez
SplunkTrust
SplunkTrust

FYI, a similar problem on the Windows platform required running a script C:\Program Files\Splunk\etc\apps\TA-uas_parser\bin\update_cache.py as:

%SPLUNK_HOME%\bin\splunk cmd python update_cache.py

or

"%SPLUNK_HOME%"\bin\splunk cmd python update_cache.py

Depending on how you have quoted your splunk_home path.

gkanapathy
Splunk Employee
Splunk Employee

You need to set the Splunk environment first. The easiest way is to invoke python using $SPLUNK_HOME/bin/splunk cmd python test.py. You could also do (in bash or sh) source $SPLUNK_HOME/bin/setSplunkEnv, then call python test.py.

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...