topic Re: How to set python script to run automatically on a custom app. in Splunk Search

How to set python script to run automatically on a custom app.

splunkbot22 — Fri, 20 Jul 2018 08:27:05 GMT

Hello guys, I am new to Splunk. I need help in letting the python script i have created to run automatically every month. My python script is able to get API JSON output and create a lookup file or update existing one. Now i need it to run it automatically in the APPS/bin folder i have already configured the inputs.conf file but the script is not or creating the csv lookup file!

Re: How to set python script to run automatically on a custom app.

thambisetty — Fri, 20 Jul 2018 10:10:27 GMT

Hi,

Please paste here your inputs.conf and the location of python file.

Re: How to set python script to run automatically on a custom app.

markuxProof — Fri, 20 Jul 2018 14:08:01 GMT

Hi, splunkbot22.

you can use the interval property with the crontab syntax:

interval = [<number>|<cron schedule>]

Ex:
[script:// ./bin/script_name ]
interval = 30 12 * */12 * #[ At 12:30 in every 12th month. ]
index = index_name
source = source_name
sourcetype = sourcetype_name

As for the output of the script, you do not need to generate a csv, just make an impression of the data in the standard output that Splunk will collect this data.

If you have any questions about the syntax of crontab, you can use this site as a reference: Crontab.guru

Re: How to set python script to run automatically on a custom app.

splunkbot22 — Sun, 22 Jul 2018 12:44:24 GMT

Hi,

Thank you for the reply, i have already add the script and interval properties in the inputs.conf under the default directory on my app. However can you further elaborate how do i make an impression of the data in the standard output? Or append he api response into the csv file?

Re: How to set python script to run automatically on a custom app.

splunkbot22 — Sun, 22 Jul 2018 12:48:30 GMT

Hi,
the location of my python file is under /app/bin and the location of the inputs.conf file is in the /apps/default directory of my app .

Content of my inputs.conf is
[script://opt/splunk/etc/apps/School/bin/retreivefromthreatcrowd.py]
interval=60
disabled=false
source=script://./bin/retreivefromthreadcrowd.py

Re: How to set python script to run automatically on a custom app.

splunkbot22 — Sun, 22 Jul 2018 12:50:26 GMT

Hello,
Thanks for the reply, I had already set the interval crontab syntax in the inputs.conf file. However can you elaborate more how i can make an impression of the data? And how i can update the existing lookups file with it?

Re: How to set python script to run automatically on a custom app.

jkat54 — Sun, 22 Jul 2018 18:04:11 GMT

You can create a modular input:
http://dev.splunk.com/view/python-sdk/SP-CAAAER3

Or you can make your script write the csv to a location that you also monitor in inputs.conf.

Re: How to set python script to run automatically on a custom app.

jkat54 — Sun, 22 Jul 2018 18:10:42 GMT

Scripted inputs will index everything on stdout from the execution of the script.

So you could just print your csv to the screen

import csv
with open('eggs.csv', 'rb') as csvfile:
      Reader = csv.reader(csvfile, delimiter=',', quote-char='”’)
      for row in Reader:
            print(row)

Re: How to set python script to run automatically on a custom app.

ashikuma — Sat, 29 Sep 2018 08:42:20 GMT

Can we have some python script which will create inputs.conf stanza by pulling log file location from word\csv file.
Note- Index will be same for all , only sourcetype will be changed which will be name of log file.

Re: How to set python script to run automatically on a custom app.

jkat54 — Sun, 30 Sep 2018 00:40:11 GMT

Yes you can do many things with python.

Re: How to set python script to run automatically on a custom app.

ddrillic — Sun, 30 Sep 2018 00:40:26 GMT

Makes perfect sense @ashikuma.

For example, I use a python a base script like this to build pieces of my ever changing serverclass.conf -

import sys


input_file       = "<location>/<file>.txt"

i = 0
f = open(input_file)
for line in f:
    # strip the new line character
    line = line[:-1]
    parts = line.split("$")


    print 'whitelist.' + str(i) + ' = ' + line + '<domain>'
    i = i + 1


f.close()