Getting the error: External search command 'testps' returned error code 1. .

jdhart1312 — Tue, 21 May 2024 15:05:49 GMT

I'm trying to run personal scripts in Splunk from a dashboard. I want the dashboard to call a script by user input and then output the script to a table. I'm testing the ability with a Python script that calls a PowerShell script, returns the data to the Python script, and then returns the data to the Splunk dashboard. This is what I have so far:

Test_PowerShell.py Python Script:

import splunk.Intersplunk import sys import subprocess results,unused1,unused2 = splunk.Intersplunk.getOrganizedResults() # Define the path to the PowerShell script ps_script_path = "./Test.ps1" # Define the argument to pass to the PowerShell script argument = sys.argv[1] # Execute the PowerShell script with the argument results = subprocess.run(['powershell.exe', '-File', ps_script_path, argument], capture_output=True, text=True) splunk.Intersplunk.outputResults(results)

Page XML:

<form version="1.1" theme="dark"> <label>Compliance TEST</label> <description>TESTING</description> <fieldset submitButton="false" autoRun="false"></fieldset> <row> <panel> <title>Input Panel</title> <input type="text" token="user_input"> <label>User Input:</label> <default>*</default> </input> </panel> </row> <row> <panel> <title>Script Output</title> <table> <search> <query>| script python testps $user_input$ | table field1</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>

Test.ps1 PowerShell Script:

Write-Host $args[0]

commands.conf:

[testps] filename = Test_PowerShell.py streaming=true python.version = python3

default.meta

[commands/testps] access = read : [ * ], write : [ admin ] export = system [scripts/Test_PowerShell.py] access = read : [ * ], write : [ admin ] export = system

The error I'm getting is the following: External search command 'testps' returned error code 1.

topic Getting the error: External search command 'testps' returned error code 1. . in Splunk Dev

Getting the error: External search command 'testps' returned error code 1. .