topic Re: How to show output of script to Splunk without indexing it in Splunk Search

How to show output of script to Splunk without indexing it

sieutruc — Fri, 02 Nov 2012 15:03:21 GMT

Hello Splunkers,

I have a script that outputs data in tabular form to console.

For exp:

machine state

A ON

B OFF

After that, i get this ouput via python by using:

output=subprocess.check_output("memory.bat", shell=True)

I wrote a function named showoutput.py like search command.
My question is how to show that output above in Splunk without indexing it via a search like:

| script python showoutput memory.bat

In my company, there are a lot of machine, the importance is to catch all their current states in real time. The historic data is already resolved with another tool.

Re: How to show output of script to Splunk without indexing it

MHibbin — Fri, 02 Nov 2012 15:55:27 GMT

You could set it up as a custom command, that doesn't actually work like the typical custom command.

For example you could create a generic search on "*" and a small time range. Then pipe to your new custom command which runs your script in the background, but it will display the output as results (i.e. anything written to STDOUT).

Quite easy to set a command up, just use the following:

http://docs.splunk.com/Documentation/Splunk/5.0/Search/AddthecustomcommandtoSplunk

Think that is probably the easiest way to just simply plug your script into Splunk. You could probably do a scripted lookup, but that might require you changing the script.