Why am I getting error "can't find xxx.csv" using a oneshot search and lookup via Python?

[afg797s]

Hello all,

I am trying to run a oneshot search in Python that contains a lookup function of a .csv. I can run any other search through my Python app as long as it doesn't contain a lookup. When I run the search in Splunk it works fine. When I run the lookup in Python, I get an error saying can't find xxx.csv. Is there a way to use a oneshot search and lookup via python?

Thanks

[jkat54 · Accepted solution]

Yes, and you're probably doing it correctly... except for I'm assuming the lookup "doesnt exists" for one of the following reasons:

User you're using with oneshot doesnt have read access to lookup (splunk permissions fix)
Lookup.csv is owned by someone other than the user that is running splunkd (linux permissions / chown to fix)
Lookup.csv is not on the server you're querying

Also you should enable_lookups on your oneshot:

There's a good explanation here under "GET search/jobs/export"... search the page for enable_lookups. Sometimes it defaults to true, but not always... and maybe they've changed it to default to false, etc.

http://dev.splunk.com/view/java-sdk/SP-CAAAEHQ