Use an external script to pass values to search query

bxsplunkuser — Thu, 08 May 2014 15:07:04 GMT

We need to be able to use the results of an external command as inputs into a search query.

Specifically, we want to run a Python script that queries our AD and exclude the members of a group from search results. The Python script is all set but the integration into the query is confusing.

transforms.conf

[HRUserException]

external_cmd = my_script.py

external_type = python

Script output:

value1

value2

value3

How can we integrate this so that the output is used as a NOT condition? Script and output can be modified too.

Thanks!

Re: Use an external script to pass values to search query

martin_mueller — Thu, 08 May 2014 17:27:49 GMT

Assuming your script results yield one event per excluded user with a user field set to its login, you can do this:

sourcetype=something NOT [HRUserException]

That will take the results of the subsearch, for example these events:

1: user=foo
2: user=bar
3: user=baz

and turn that into this search string:

( ( user="foo" ) OR ( user="bar" ) OR ( user="baz" ) )

The NOT in front of the subsearch will exclude those three users from the search, giving you this main search:

sourcetype=something NOT ( ( user="foo" ) OR ( user="bar" ) OR ( user="baz" ) )

If your external command results don't have a user field yet you may need to rex it out of the results first.

topic Use an external script to pass values to search query in Splunk Dev

Use an external script to pass values to search query

Re: Use an external script to pass values to search query