- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm trying to use a Python script with a custom module for a external lookup on Splunk. When running
/opt/splunk/bin/splunk cmd python /opt/splunk/etc/apps/search/bin/gib_detect.py
to test the script I get the following error:
Traceback (most recent call last):
File "/opt/splunk/etc/apps/search/bin/gib_detect.py", line 18, in <module>
import gib_detect_train
ModuleNotFoundError: No module named 'gib_detect_train'
But when running the same script outside Splunk folders with
/opt/splunk/bin/splunk cmd python /home/myuser/gib_detect.py
It works as intended.
What I am doing wrong?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That was my bad. The import is actually calling another file, the gib_detect_train.py, and was required inside the bin folder as well.
And I will be following the @richgalloway advice of storing the files in a custom app.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That was my bad. The import is actually calling another file, the gib_detect_train.py, and was required inside the bin folder as well.
And I will be following the @richgalloway advice of storing the files in a custom app.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Did you include gib_detect.py in /opt/splunk/etc/apps/search/lib? It's probably in your home folder, but not in the Splunk folder.
BTW, it's best to create external commands in custom apps rather than in the search app.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have this same .py file both in my home directory and inside /opt/splunk/etc/apps/search/bin.
Should I create a lib folder inside the search app to store the .py file? Shouldn't the binaries be stored inside a bin folder?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Library files can be in <app>/bin/lib or <app>/lib.
I would resist the temptation to change the file structure of a standard app. Put your external command into a new app.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I appreciate your help.
I didn't provide all the detais about the script, and actually was missing another file inside the bin folder.
I'll be using a custom app to keep the search app folder clean.
