topic Re: How to write a file into the app folder through a python script in Splunk Dev

How to write a file into the app folder through a python script

RiccardoV — Fri, 30 May 2014 10:39:51 GMT

Hi,
I have to schedule a script execution in my splunk app with Splunk 6.1.
I think to do that with a scheduled query, something like

| script python my_script

adding in my commands.conf file:

[my_script]
filename = my_script.py
stderr_dest = message

here is my_script.py:

with open('example.txt', 'wb') as handle:
    handle.write("this is a test")

I tried to launch manually the query. It returns no errors but I can't find example.txt file. What am I doing wrong?

Re: How to write a file into the app folder through a python script

jhupka — Fri, 30 May 2014 14:28:55 GMT

Look into what is called a Scripted Input, defined in the inputs.conf of your app. Running a search to execute a script is a bit "heavy." The scripted input can be set to execute however often you want, and splunkd will execute it for you on that schedule. Also, the Std Out of your script would get indexed as well, so make sure you configure the index, source, sourcetype for it to show where you want that data to go. The script itself could do anything - write your file, run a unix command (that's how the unix app stuff works in Splunk), fetch data from an external source for indexing, etc.

Also, what you did in commands.conf above would be for creating a custom search command in Splunk. E.g. you want to make a new command called my_script:

 ... | eval foo="bar" | my_script | head 10

Re: How to write a file into the app folder through a python script

RiccardoV — Tue, 03 Jun 2014 08:04:27 GMT

Thanks for your reply, but I still don't understand how to write a file from a python script. Where can I find my script's output?

Re: How to write a file into the app folder through a python script

RiccardoV — Tue, 03 Jun 2014 08:34:39 GMT

Finally I understand why it didn't working 🙂

I have to use absolute path:

import os
filepath = os.path.join(os.environ['SPLUNK_HOME'], 'etc', 'apps', APP_NAME, TARGET_DIR, "test.txt")

with open(filepath, 'wb') as handle:
  handle.write("test")

and it works like a charm 🙂