https://community.splunk.com/t5/Splunk-Search/How-to-configure-Splunk-with-my-python-script-for-an-external/m-p/427848#M122469 <PRE><CODE>fields_list = &lt;string&gt;: is a list of all fields that are supported by the external lookup. The fields must be delimited by a comma followed by a space. </CODE></PRE> <P>The above was in the link you shared. Please read the link again very carefully and I think you’ll resolve your problem.</P> <P>Where will you “return csv”? Should it return as events in the search pipeline? Or are you making your external lookup code write a csv somewhere on the file system?</P> Mon, 04 Jun 2018 18:26:23 GMT jkat54 2018-06-04T18:26:23Z https://community.splunk.com/t5/Splunk-Search/How-to-configure-Splunk-with-my-python-script-for-an-external/m-p/427847#M122468 <P>Hi,</P> <P>I want to build my own python code that gets parameter IP address, My script using IP2Location and return information about the IP address with IP2Location DB IP2Location<BR /> <A href="https://www.ip2location.com/developers">https://www.ip2location.com/developers</A></P> <P>So what I did is build my python script that receives IP address and returns CSV row with the result of IP2Location.<BR /> My script is located in: <BR /> <CODE>/opt/splunk/etc/apps/search/bin</CODE></P> <P>And in transforms.conf I configured According this tutorial:<BR /> <A href="https://docs.splunk.com/Documentation/SplunkCloud/7.0.3/Knowledge/Configureexternallookups">https://docs.splunk.com/Documentation/SplunkCloud/7.0.3/Knowledge/Configureexternallookups</A> </P> <PRE><CODE>[ip2location] external_cmd = ip2location.py clientip fields_list = What shold I write here? </CODE></PRE> <P>I'm trying to understand:<BR /> 1. How do I need to configure the section on [ip2location] in transform.conf?<BR /> 2. What is the meaning of fields_list?<BR /> 3. How can I make my script to work in Splunk? I just want Splunk to give my script IP address and return csv as result.</P> <P>Thanks</P> Mon, 04 Jun 2018 14:42:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-configure-Splunk-with-my-python-script-for-an-external/m-p/427847#M122468 yko84108 2018-06-04T14:42:21Z https://community.splunk.com/t5/Splunk-Search/How-to-configure-Splunk-with-my-python-script-for-an-external/m-p/427848#M122469 <PRE><CODE>fields_list = &lt;string&gt;: is a list of all fields that are supported by the external lookup. The fields must be delimited by a comma followed by a space. </CODE></PRE> <P>The above was in the link you shared. Please read the link again very carefully and I think you’ll resolve your problem.</P> <P>Where will you “return csv”? Should it return as events in the search pipeline? Or are you making your external lookup code write a csv somewhere on the file system?</P> Mon, 04 Jun 2018 18:26:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-configure-Splunk-with-my-python-script-for-an-external/m-p/427848#M122469 jkat54 2018-06-04T18:26:23Z https://community.splunk.com/t5/Splunk-Search/How-to-configure-Splunk-with-my-python-script-for-an-external/m-p/427849#M122470 <P>Hi,<BR /> About 1 - I read that, but what that is mean about my csv? I need to write my csv fields?<BR /> "return csv" - mean I'm using python the use csv.writer to write to sys.stdout not to file system</P> Tue, 05 Jun 2018 06:23:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-configure-Splunk-with-my-python-script-for-an-external/m-p/427849#M122470 yko84108 2018-06-05T06:23:57Z