topic Re: Couldn't run script command in Splunk Search

Couldn't run script command

EdSplunk — Fri, 15 Apr 2011 04:02:10 GMT

Based on reference: http://www.splunk.com/base/Documentation/4.2/SearchReference/Script

I created a perl file that just outputs the arguments to a file. I called it test.pl and saved it under splunk_home/etc/searchscripts (I had to create the directory since it didn't exist).

I built my search

permit dst=192.* | stats count dst | script perl test.pl

but I keep getting an error:

Error in 'script' command: The external search command 'test.pl' does not exist in commands.conf.

Can anyone point me in the right direction?

Re: Couldn't run script command

malbertdr — Fri, 15 Apr 2011 04:02:11 GMT

I don't believe perl is currently supported. Only python.

Re: Couldn't run script command

dwaddle — Fri, 15 Apr 2011 04:51:55 GMT

Based on the error, your script needs to be defined in commands.conf, something similar to:

[test]
FILENAME = test.pl

See http://www.splunk.com/base/Documentation/latest/Admin/Commandsconf for details on commands.conf, and http://www.splunk.com/base/Documentation/latest/SearchReference/Aboutcustomsearchcommands for more details about defining your custom search command.

Re: Couldn't run script command

EdSplunk — Fri, 15 Apr 2011 14:57:15 GMT

Actually, it is, based on the said reference.

Re: Couldn't run script command

echalex — Wed, 08 Aug 2012 08:41:21 GMT

The error message certainly suggests you need to put this in commands.conf. However, the documentation for script doesn't mention that. Furthermore, having the script in commands.conf makes using the script command redundant.