topic Re: Python script execution from Splunk GUI in Installation

Python script execution from Splunk GUI

manish_singh_77 — Fri, 17 Apr 2020 13:20:06 GMT

Hi Team,

We have a python script which runs and executes the results of the knowledge objects of rest apis. We are going to run this script on adhoc basis which will modify and list the permissions. Do we have to use custom search command for that?

If yes then please let us know the approach...

Re: Python script execution from Splunk GUI

manjunathmeti — Fri, 17 Apr 2020 14:27:49 GMT

You can create a custom alert action to trigger python script using steps provided here:

https://answers.splunk.com/answers/810829/problem-with-scripted-alert.html#answer-810832

And use sendalert command to trigger script.

<base search> | sendalert scriptcustomalert

Re: Python script execution from Splunk GUI

manish_singh_77 — Wed, 30 Sep 2020 05:03:08 GMT

@manjunathmeti ,

I have a python script, for now I am executing the commands from the server and getting the results.

For example: /opt/splunk/bin/splunk cmd python /home/splunk/test_Script.py list savedsearch --user test_user

This will return the results once executed from the server, how we do the same thing from GUI?

Re: Python script execution from Splunk GUI

manjunathmeti — Mon, 20 Apr 2020 13:15:16 GMT

If you want to run a script as command and get results in search app then you need to create a custom search command. Check this:

https://dev.splunk.com/enterprise/docs/developapps/customsearchcommands/createcustomsearchcmd

If you listing all saved searches, you can use below search query:

| rest /servicesNS/-/-/saved/searches  | table title,cron_schedule,next_scheduled_time,eai:acl.owner,actions,eai:acl.app

Re: Python script execution from Splunk GUI

manish_singh_77 — Tue, 21 Apr 2020 07:40:25 GMT

@manjunathmeti

Thanks for your reply, slight correction from my end, we can also use curl utility to modify the permissions, right?

Re: Python script execution from Splunk GUI

manjunathmeti — Tue, 21 Apr 2020 10:29:08 GMT

If you are asking about modifying the splunk objects (like savedsearches, views etc.) permissions using REST API calls using curl utility, then yes you can use that.

Check this link:
https://docs.splunk.com/Documentation/Splunk/8.0.3/RESTTUT/RESTbasicexamples

Re: Python script execution from Splunk GUI

manish_singh_77 — Tue, 21 Apr 2020 11:42:04 GMT

@manjunathmeti

Do you have any sample python script?