Splunk Dev

Using Lookup in Python SDK

MK3
Explorer

Hello,

I have a query -

searchquery_oneshot = "search (index=__* ... events{}.name=ResourceCreated) | dedup \"events{}.tags.A\" | spath \"events{}.tags.A\" || lookup Map.csv \"B\" OUTPUT \"D\" | table ... | collect ...

I ran this using Python SDK in VSCode as -

oneshotsearch_results = service.jobs.oneshot(searchquery_oneshot, **kwargs_oneshot)
conn.cursor().execute(sql, val)

I ran the above using psycopg2 and got this error-
FATAL: Error in 'lookup' command: Could not construct lookup 'Map.csv, B, OUTPUT, D'. See search.log for more details.

The above query works when run inside splunk enterprise i.e. map.csv is looked-up and result fetched correctly.
How do I locate my search.log? It is  splunkhome/var/lib/dispatch/run I assume. What is the error above?

Thanks

Labels (2)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@MK3- I believe its an permission and/or app-context issue.

When you create service object,

  • Provide the same username you use to login on Splunk UI
  • Provide the same App name which you use on UI and search works fine
service = client.connect(host="<ip/hostname>", username="<username>", password="<user-passwd", app="<same app as you use on UI>")

 

I hope this helps!!!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried using a kv store instead of csv as I know that csv lookup don't work for python custom commands?

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...