Splunk Search

Why am I getting error "can't find xxx.csv" using a oneshot search and lookup via Python?

afg797s
Engager

Hello all,

I am trying to run a oneshot search in Python that contains a lookup function of a .csv. I can run any other search through my Python app as long as it doesn't contain a lookup. When I run the search in Splunk it works fine. When I run the lookup in Python, I get an error saying can't find xxx.csv. Is there a way to use a oneshot search and lookup via python?

Thanks

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Yes, and you're probably doing it correctly... except for I'm assuming the lookup "doesnt exists" for one of the following reasons:

User you're using with oneshot doesnt have read access to lookup (splunk permissions fix)
Lookup.csv is owned by someone other than the user that is running splunkd (linux permissions / chown to fix)
Lookup.csv is not on the server you're querying

Also you should enable_lookups on your oneshot:

There's a good explanation here under "GET search/jobs/export"... search the page for enable_lookups. Sometimes it defaults to true, but not always... and maybe they've changed it to default to false, etc.

http://dev.splunk.com/view/java-sdk/SP-CAAAEHQ

View solution in original post

jkat54
SplunkTrust
SplunkTrust

Yes, and you're probably doing it correctly... except for I'm assuming the lookup "doesnt exists" for one of the following reasons:

User you're using with oneshot doesnt have read access to lookup (splunk permissions fix)
Lookup.csv is owned by someone other than the user that is running splunkd (linux permissions / chown to fix)
Lookup.csv is not on the server you're querying

Also you should enable_lookups on your oneshot:

There's a good explanation here under "GET search/jobs/export"... search the page for enable_lookups. Sometimes it defaults to true, but not always... and maybe they've changed it to default to false, etc.

http://dev.splunk.com/view/java-sdk/SP-CAAAEHQ

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...