topic How to trigger script with arguments from Splunk search? in Getting Data In

How to trigger script with arguments from Splunk search?

koshyk — Tue, 29 Sep 2020 13:00:14 GMT

I was able to make splunk send alert to my abc_pythonscript correctly after configuring commands.conf

| makeresults | eval myfield="some_raw_message" | table myfield| script abc_pythonscript myfield

But when I look into the arguments coming to my script, is myfield rather than the value within it. I was expecting the value of "some_raw_message" to be passed to my script.

Is it a mistake I'm doing or any better ways to do this?

Re: How to trigger script with arguments from Splunk search?

woodcock — Tue, 21 Feb 2017 17:43:07 GMT

Like this:

 | makeresults | eval myfield="some_raw_message" |map search="| makeresults | abc_pythonscript $myfield$"

Re: How to trigger script with arguments from Splunk search?

koshyk — Wed, 22 Feb 2017 12:23:04 GMT

great thanks. worked like a charm

Re: How to trigger script with arguments from Splunk search?

vadivel_parames — Thu, 04 Apr 2019 13:53:37 GMT

Hi Koshyk,

I have a similar requirement. Would be helpful if you could share the script how you are passing the splunk alert values into a python script.
Thanks!

Re: How to trigger script with arguments from Splunk search?

koshyk — Wed, 30 Sep 2020 00:02:38 GMT

hi mate
1. create a python script (say my_python_script)
2. Ensure it has permissions to read from the app context
3. Run your base query and output results as you wish for your python script
4. and as answer given above pass those into a "map" command

Re: How to trigger script with arguments from Splunk search?

woodcock — Sun, 07 Apr 2019 15:00:31 GMT

You should really post a new question, but perhaps my (unaccepted) answer here helps?
https://answers.splunk.com/answers/41949/passing-search-results-to-external-python-script.html

Re: How to trigger script with arguments from Splunk search?

highsplunker — Mon, 03 Jun 2019 14:31:08 GMT

Could you please share abc_pythonscript ?
See my answer below (worked).

Re: How to trigger script with arguments from Splunk search?

highsplunker — Mon, 10 Jun 2019 14:44:58 GMT

This worked for me:

step 1. in search box of web interface
| makeresults | jonsnow dest="bbb", source="bla-bla-bla"

step 2. for "jonsnow" custom command to work
write this in commands.conf
[jonsnow]
filename = jonsnow.py

and this to local.meta of the same Splunk app

[commands/jonsnow]
access = read : [ * ], write : [ admin, power ]
export = system
owner = myusername

step 3. the script itself (jonsnow.py)
import splunk.Intersplunk
import subprocess
keywords, argvals = splunk.Intersplunk.getKeywordsAndOptions()
xxx = argvals['xxx']
yyy = argvals['yyy']
subprocess.call(["sh", "./jonsnow.sh", xxx, yyy])

Re: How to trigger script with arguments from Splunk search?

highsplunker — Wed, 30 Sep 2020 00:54:20 GMT