topic Re: how i write external_cmd python script in Splunk Dev

how i write external_cmd python script

zchandikaz — Sun, 07 Jun 2020 18:11:17 GMT

I need to alter data in splunk using props.conf
I need to use external_cmd to run python script
Can you give me a example python script for that.

Thanks

Re: how i write external_cmd python script

richgalloway — Sun, 10 May 2020 19:35:48 GMT

Data in Splunk cannot be altered using props.conf or any other means.
Data arriving at Splunk can be modified using transforms.conf. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Anonymizedata for an example.

See https://docs.splunk.com/Documentation/Splunk/8.0.3/Search/Writeasearchcommand for how to write an external command.

Re: how i write external_cmd python script

zchandikaz — Mon, 11 May 2020 02:11:03 GMT

Yes
Do you know alter data in transforms.conf using python program. I couldn't find a example to alter using python as i alter data using SEDCMD.

Thank you very much

Re: how i write external_cmd python script

richgalloway — Mon, 11 May 2020 11:38:57 GMT

If your python program is a scripted or modular input then you can make all the changes you like. It won't involve transforms.conf, however.
Or do you want to change the transforms.conf file itself using python? If so, I don't have an answer.

Re: how i write external_cmd python script

zchandikaz — Mon, 11 May 2020 12:33:40 GMT

No No
I simply want to mask some data using transforms.conf and props.conf. I know how to do it using SEDCMD or EVAL.But i need to consider more conditions before masking. So i need to use a python script to do it. But i don't know how to do it

Thanks

Re: how i write external_cmd python script

richgalloway — Tue, 12 May 2020 12:29:52 GMT

You seem to be contradicting yourself. You say you want to use transforms, but you don't want to use SEDCMD or EVAL, which are the methods offered by transforms. Like I said previously, a python script used as a modular or scripted input can make any alterations it wants to.
Perhaps you should describe what kind of data is involved, how it is being onboarded, and what it should look like in Splunk.

Re: how i write external_cmd python script

zchandikaz — Tue, 12 May 2020 12:33:43 GMT

simply i need to mask data in events
before masking i need to consider log level, logger and some conditions
So if i can write a script to mask, it'll be easy

Re: how i write external_cmd python script

richgalloway — Tue, 12 May 2020 16:49:47 GMT

Yes, a script can do that, but the data must be read by the script. It is not possible for a script to process data as it passes through an indexer.

Re: how i write external_cmd python script

zchandikaz — Tue, 12 May 2020 16:52:11 GMT

yes i'll find another alternative, thank you very much