<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: feeding fields to an external script in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/feeding-fields-to-an-external-script/m-p/96585#M20132</link>
    <description>&lt;P&gt;Make sure you have the command listed in transforms.conf with the input of 'host'&lt;/P&gt;

&lt;P&gt;If you do, then it will only take the field named 'host' unless you use the following example:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;search&amp;gt; | showmount host as &amp;lt;your_input_field&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Fri, 15 Nov 2013 23:43:39 GMT</pubDate>
    <dc:creator>pryzrak</dc:creator>
    <dc:date>2013-11-15T23:43:39Z</dc:date>
    <item>
      <title>feeding fields to an external script</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/feeding-fields-to-an-external-script/m-p/96584#M20131</link>
      <description>&lt;P&gt;I've written a little python one-liner that basically calls showmount -a with an argv array at the end and my goal is to be able to feed it a list of hosts and get the showmount output for each host.&lt;/P&gt;

&lt;P&gt;if I do:&lt;BR /&gt;
| showmount &lt;HOSTNAME&gt;&lt;/HOSTNAME&gt;&lt;/P&gt;

&lt;P&gt;this works&lt;/P&gt;

&lt;P&gt;if I do&lt;/P&gt;

&lt;P&gt;host=pattern* | showmount host&lt;/P&gt;

&lt;P&gt;nothing happens.&lt;/P&gt;

&lt;P&gt;this is the extent of my oneliner:&lt;/P&gt;

&lt;P&gt;subprocess.call(['showmount', '-a', sys.argv[1]])&lt;/P&gt;

&lt;P&gt;What can I do to make this actually show me a list per host with each host being an event?&lt;/P&gt;</description>
      <pubDate>Tue, 16 Jul 2013 14:28:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/feeding-fields-to-an-external-script/m-p/96584#M20131</guid>
      <dc:creator>mjones414</dc:creator>
      <dc:date>2013-07-16T14:28:48Z</dc:date>
    </item>
    <item>
      <title>Re: feeding fields to an external script</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/feeding-fields-to-an-external-script/m-p/96585#M20132</link>
      <description>&lt;P&gt;Make sure you have the command listed in transforms.conf with the input of 'host'&lt;/P&gt;

&lt;P&gt;If you do, then it will only take the field named 'host' unless you use the following example:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;search&amp;gt; | showmount host as &amp;lt;your_input_field&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 15 Nov 2013 23:43:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/feeding-fields-to-an-external-script/m-p/96585#M20132</guid>
      <dc:creator>pryzrak</dc:creator>
      <dc:date>2013-11-15T23:43:39Z</dc:date>
    </item>
  </channel>
</rss>

