Actually my case is different from the root cause point of view.
I run the following search:
search index="_audit" | fit LinearRegression linecount from _time
So 'fit' fails in case PYTHONUNBUFFERED env var is set and does not fail if it is not set.
Versions are Splunk 8.0.1, MLTK 5.0.0, PSC 2.0.0 with python 3.7.
... View more
I've just run into the same issue while I wanted to run a 'fit' command with Splunk Machine Learning Toolkit 4.5.0, though I could not reproduce it with MLTK 4.0.0.
It seems that the problem comes up when PYTHONUNBUFFERED environmental variable is set. There is no error if the env var is not set.
In my case stderr stream is handled somehow as transport header:
02-10-2020 10:05:07.837 INFO ChunkedExternProcessor - Running process: /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/Splunk_ML_Toolkit/bin/fit.py
02-10-2020 10:05:07.870 ERROR ChunkedExternProcessor - Failed attempting to parse transport header: INFO Running /opt/splunk/etc/apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/bin/python /opt/splunk/etc/apps/Splunk_ML_Toolkit/bin/fit.py <_io.TextIOWrapper name='<stderr>' mode='w' encoding='UTF-8'>
I guess the INFO part of the printout is supposed to be directed to stderr.
Can you Splunk guys investigate the above one?
... View more