search

splunk / splunk-sdk-python

Splunk Software Development Kit for Python
http://dev.splunk.com
Apache License 2.0
698 stars 370 forks source link

Key Error in Python Splunk SDK while accessing KV store #498

Closed souravsharma6633 closed 1 year ago

souravsharma6633 commented 2 years ago

Hi, I am facing the same KeyError issue as referenced here https://github.com/splunk/splunk-sdk-python/issues/256 . But, I already have the collection defined in collections.conf file. I am able to CRUD the collection from the rest API but custom command is giving this KeyError. Urgent help is needed.

Thanks, Sourav

souravsharma6633 commented 2 years ago

On my local, when I am the admin it's working fine. But, on company hosted splunk, it is throwing the error. I am even able to access it using SPL command (inputlookup) also. But, the custom command is giving error.

akaila-splunk commented 1 year ago

Hi @souravsharma6633 , Would you please share the steps to reproduce the issue. Based on our initial analysis it seems like an access issue, so if you share the your use case we may be able to identify the root cause.

souravsharma6633 commented 1 year ago

Hi @akaila-splunk, I am having a KVStore and lookup defined in collections.conf/transfomrms.conf. What I debugged till now is when I am trying to access KVStore using client.connect function of splunklib, it is being called once by the stream function. I am using the StreamingCommand to stream, process and yield the data. But, the internal logs show that the storage/collections/config is being called on the search head I am connecting to ..and all the indexers. The search head is giving a 200 response while the indexers are giving 404 error. I am getting KeyError as if my collection in KVStore does not exist. I have tried using local=true in commands.conf also for my custom command. But, still same behavior. FYI, inputlookup/outputlookup commands work fine with all the requests going to SH only. API is also working fine.

Now, I need inputs on what can be the issue? Need some fast response as the issue is being persistent for 2 weeks and I am not able to proceed.

Thanks and Regards, Sourav

akaila-splunk commented 1 year ago

Hi @souravsharma6633, we have tried to access the kvstore from the CSC app with the code mentioned in issue#256 but unable to reproduce issue on our end, we are getting the data without any errors. so requesting you to share the .py script file code along with .conf files and spl query, and information about the environment along with version details, will help us to reproduce the issue.

akaila-splunk commented 1 year ago

Closing the Issue as we haven't received any response. @souravsharma6633 please reopen the Issue if you still face the issue.