topic Custom Command Help in Splunk Search

Custom Command Help

daniel333 — Fri, 19 Oct 2018 21:24:20 GMT

All,

I am no developer and burned a couple hours on the making custom commands docs and conf sessions and feel like I am no closer. So hoping someone can give me a basic template to wrap this in?

Basically I have this script (works on python 2 and 3 unchanged). I'd like to pass my custom command a value which is a securitycode and return the value from my script. How can I get this done? Anyone have a template?

#!/usr/bin/env python3.5
import sys


hsh = [
     (1 , 'Known Violators'),
     (2 , 'Blocked Country'),
     (4 , 'Browser Integrity Check'),
     (8 , 'Known Violator User Agent'),
    (16 , 'Rate Limited'),
    (32 , 'Known Violator Honeypot Access'),
    (64 , 'Referrer Block'),
   (128 , 'Session Length Exceeded'),
   (256 , 'Pages Per Session Exceeded'),
   (512 , 'Bad User Agents'),
  (1024 , 'Aggregator User Agents'),
  (2048 , 'Filtered IP'),
  (4096 , 'JavaScript Not Loaded'),
  (8192 , 'JavaScript Check Failed'),
 (16384 , 'Identifier Validation Error'),
 (32768 , 'Known Violator Automation Tool'),
 (65536 , 'Form Spam Submission'),
(131072 , 'Unverified Signature'),
(262144 , 'IP Pinning Failure'),
(524288 , 'Invalid JavaScript Test Results'),
(1048576 , 'Organization Block'),
(2097152 , 'Known Violator Data Center'),
(4194304 , 'ACL User Agent'),
(8388608 , 'ACL ID'),
(16777216 , 'ACL Header'),
(134217728 , 'ACL Extension'),
(268435456 , 'Missing Unique ID'),
(536870912 , 'Requests Per Minute')
]

def help():
    print("threat_extract.py threat_number")

if __name__ == '__main__':
    if len(sys.argv) != 2:
        help()
        exit()

    threat_number = int(sys.argv[1])

    print(','.join([v for k, v in hsh if k & threat_number]))

Re: Custom Command Help

maciep — Sat, 20 Oct 2018 01:25:40 GMT

To not answer your question, you could probably just use a lookup if this is all the command is going to do.

To ask a question, how would you envision this custom command working exactly? How would you want to use it in a search exactly?

Re: Custom Command Help

daniel333 — Tue, 23 Oct 2018 14:02:12 GMT

Thanks for replying.

I am kinda forcing this as a custom command as a learning opportunity, but hitting a wall. never done one, so thought I would use the excuse.

I am expecting to pass a value (a numeric field) from the log called vendorerrorcode.

mysearch | mycustomcommand vendorerrorcode

and get a returned field an array of all the possible error codes returned from the script above.

Re: Custom Command Help

maciep — Wed, 31 Oct 2018 00:27:08 GMT

i haven't done with v2 of the sdk yet, but this does seem like a nice one to practice with. I may play with this when i have some free time. But for now, here are some thoughts.

At a high-level, i believe you'll want to create an app, put the sdk in the app, create your script in the app and create the commands.conf file to tell splunk about your script.

There is this searchcommands_app example in Splunk SDK repository. It has most of what you need to get started i think.

Then there is this section somewhere on the splunk dev site that explains what to do with that example app - where to put it and what else to put in there (some of the sdk bits).

For the code itself, i would probably base it off of this example in that app. It shows you how to make a streaming command, which basically what you're trying to do.

Not sure if any of that will help or just provide you more useless hours of reading. But if i do get a chance to play with this or if anyone else here has done something similar, hopefully we can get you a working example to get started with.

Re: Custom Command Help

gaurav_maniar — Tue, 29 Sep 2020 21:52:44 GMT

Hi,

Let's go step by step. (check the reference link, if you get stuck somewhere)
Ref 1 - http://docs.splunk.com/Documentation/SplunkCloud/7.0.5/Search/Customcommandlocation
Ref 2 - https://docs.splunk.com/Documentation/Splunk/7.2.0/Search/Customsearchcommandshape

As you are doing this for learning, I wont provide all the details. Following details will get you going.
If you need more help, you are welcome.

Download Splunk Python SDK from the link, and copy 'splunklib' folder - http://dev.splunk.com/python
Create an app with 'bin' and other required folders and paste the 'splunklib' folder inside bin folder
Create commands.conf file inside default folder, with following configuration.

[command_name]
filename = python_file.py
supports_rawargs = true
Now create a python_file.pyinside 'bin' directory created at step 2. As details provided in reference 2, use the pre-defined code to capture command argument, process the results and push the new results/modified data by command back to Splunk.
If python_file.py is using any other python file, than you have to import it with full path.

if this helps, don't forget to accept this answer.

cheers 🙂