topic Re: Script command : Error in 'script' command: The external search command Error in Getting Data In

Script command : Error in 'script' command: The external search command Error

koshyk — Tue, 17 Dec 2013 10:33:06 GMT

I'm having issues while running script command within the search. I've tried running something like ..

| savedsearch UsersCount_byDomain_Pie | script python SavedSearch.py

I've updated "commands.conf" in $SPLUNK_HOME/etc/apps/myApp/local (also tried $SPLUNK_HOME/etc/apps/myApp ) and have restarted splunk

cat commands.conf
[samplePython]
FILENAME = SavedSearch.py

I've kept the script under $SPLUNK_HOME/etc/apps/myApp/bin

Error Shown

Error in 'script' command: The external search command 'SavedSearch.py' does not exist in commands.conf.

I've checked the Saved Search and the python Script individually and it works.

i'm confused if I need to provide absolute path (the example shown in Splunk docs is not sufficient) in the search string?

(My confusion is "where would you keep the commands.conf and the script ?" I'm not convinced if splunk recognizes the myApp/bin directory correctly)

Re: Script command : Error in 'script' command: The external search command Error

dart — Tue, 17 Dec 2013 10:49:29 GMT

Your commands.conf should look like this:

[samplePython]
filename = SavedSearch.py

Then you can call it like so:

| savedsearch UsersCount_byDomain_Pie | samplePython

Re: Script command : Error in 'script' command: The external search command Error

koshyk — Tue, 17 Dec 2013 11:34:10 GMT

Hmm.. not working. Without script it says
Unknown search command 'samplepython'.

Re: Script command : Error in 'script' command: The external search command Error

koshyk — Tue, 17 Dec 2013 11:36:24 GMT

I saw a comment in Thread http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Script to use same name for script and stanza. Hence I tried using samplePython.py and stanza to be: samplePython . Still not working !!

Re: Script command : Error in 'script' command: The external search command Error

nivedita_viswan — Thu, 25 Jun 2015 21:04:38 GMT

I had the same problem - adding the stanza to commands.conf in the SPLUNK_HOME/etc/apps/myApp/default folder (and not local folder) calls the script correctly.

Re: Script command : Error in 'script' command: The external search command Error

faguilar — Wed, 16 Jan 2019 11:04:53 GMT

Hi,

I know this is an old question, but I got the same issue and this is how I solved it:

First, you have to create the file authorize.conf on /detault (or /local folders), having this content:

> [capability::run_script_samplePython]
> 
> [role_admin]
> run_script_samplePython=enabled

Then, you can execute the command | samplePython, but be shure you are working within the search of your app. If you want to execute the command with global permissions, you'll need to change the permissions of your app (since the app access is not allowed for global execution by default).

Hope it helps.

Re: Script command : Error in 'script' command: The external search command Error

koshyk — Thu, 31 Jan 2019 13:40:21 GMT

thanks mate.

Re: Script command : Error in 'script' command: The external search command Error

ss026381 — Fri, 19 Jul 2019 20:23:34 GMT

Thanks,
For me putting the configurations in default folder worked.
Just fyi if you put the script in system\bin and configurations in system\local it will work as well.