topic Re: How to pass parameters in custom search command without field camp? in Splunk Search

How to pass parameters in custom search command without field camp?

rmenchio — Fri, 11 Oct 2019 20:06:40 GMT

How can i run a search command passing an argument to python script via sys.argv?

My script:

import requests
import sys
import json
from splunklib.searchcommands import \
 dispatch, GeneratingCommand, Configuration, Option, validators

@Configuration()
class GenerateHelloCommand(GeneratingCommand):

    id = Option(require=True, validate=validators.Integer())


    def generate(self):



        site = "https://link/api/link.json?id=" + str(self.id) + "&username=x2&passhash=x"
        response = requests.get(site, timeout=10)
        filtro = json.loads(response.text)
        filt = filtro["sensordata"]["statustext"]
        yield {'ID' : str(self.id), 'STATUS' : filt}



dispatch(GenerateHelloCommand, sys.argv, sys.stdin, sys.stdout, __name__)

Currently i run my command like this:

| comando id=11249

and it work, but I would like to run my command like this:

| comando 11249

Such that i get 11249 into the python script like a variable. Example:

ID = arg.sysv[1]

My commands.conf:

[comando]
chunked=true
filename=comando.py

Can someone help me?

Re: How to pass parameters in custom search command without field camp?

woodcock — Sat, 12 Oct 2019 17:09:55 GMT

See my unaccepted answer here:
https://answers.splunk.com/answers/41949/passing-search-results-to-external-python-script.html
UpVotes appreciated.

Re: How to pass parameters in custom search command without field camp?

tomasmoser — Sat, 13 Jun 2020 14:38:24 GMT

I am using Python SDK. Watch "self.fieldname" routine. My command will have one argument - existing field from previous search (message_subject). With the code below I was successfull passing value from any field I add as an argument to SPL commmand: e.g. "| mimedecode message_subject"

I got inspiration from:

https://docs.splunk.com/DocumentationStatic/PythonSDK/1.6.0/searchcommands.html

class decodemimeCommand(StreamingCommand): def stream(self, records): # get the argument - fieldname with mime-encoded string message_subject = self.fieldnames[0] for record in records: record['message_subject_decoded'] = main(record[message_subject]) yield record if __name__ == "__main__": dispatch(decodemimeCommand, sys.argv, sys.stdin, sys.stdout, __name__)