topic Re: Custom whois command: Problem with passing keyword to function [Python] in Splunk Dev

Custom whois command: Problem with passing keyword to function [Python]

stephan_berger — Wed, 26 Dec 2012 09:44:11 GMT

Hello Splunk Community,

This is my small whois command:

import splunk.Intersplunk as si
import logging
import py_whois

def whois():
    host2,options = si.getKeywordsAndOptions()
    #host = "amazon.it"
    flags = 0
    nic_client = py_whois.NICClient()
    results = []
    result = nic_client.whois_lookup(None, host2, flags)
    lines = result.split('\n')
    for line in lines:
        results.append({"Whois Information for " + host : line})
    results.append({"Whois Information for " + host : line})
    #results.append({"hostname" : host2})
    return results

try: 
    results = whois()
except:
    import traceback
    stack =  traceback.format_exc()
    results = splunk.Intersplunk.generateErrorResults("Error : Traceback: " + str(stack))
si.outputResults( results )

I've got the code for the py_whois.NICClient class from here:

http://code.activestate.com/recipes/577364-whois-client/

Now, when I hardcode the host-string (i.e. amazon.it in the example above), the script works fine, but it fails when I pass the host-string I got as a keywords (getKeywordsAnd..). Do I need to convert the variable to another format before it can be passed to this function?

commands.conf

[swhois]

filename = swhois.py

Many thanks!

Best regards,
Stephan

Re: Custom whois command: Problem with passing keyword to function [Python]

Drainy — Wed, 26 Dec 2012 11:33:45 GMT

Disclaimer, I haven't given your code above a test but my thoughts are...

Firstly, without looking at the intersplunk stuff again I couldn't say how it arrives but its probably safer to cast it as a string, do something like host=str(host2)

Secondly, I always find logging helpful in these situations, look up the Python logging module or just write to a file to keep a record of your variable values so you can see where things are going wrong.

http://docs.python.org/2/library/logging.html

Re: Custom whois command: Problem with passing keyword to function [Python]

stephan_berger — Wed, 26 Dec 2012 12:23:07 GMT

Thanks for your help, Drainy, but I found the answer while looking at this thread:

Debugging custom splunk search command

args, kwargs = splunk.Intersplunk.getKeywordsAndOptions()
..
parameter1 = args[0]

ARGS is an array. I thought I have tested this as well.. nevermind, thanks again.

Best regards,
Stephan