topic How to run a Shell Script run from a search command? in Splunk Search

How to run a Shell Script run from a search command?

SirHill17 — Wed, 12 Aug 2015 09:37:42 GMT

Hi,

I am trying to run a shell script from a search command. So I have created a shell script under $SPLUNK_HOME/etc/apps/myapp/bin/ and a specific commands.conf file with the below content:

[MYSCRIPT]
type = shell
file = ./myscript.sh

Running the following command on the search bar:

| script MYSCRIPT

I got an error message which is:

The type 'shell' for command 'MYSCRIPT' in commands.conf is invalid.

As per the doc, if I understand well, we can only use python or perl?

filename = "string"
    * Name of script file for command.
    * <script-name>.pl for perl.
    * <script-name>.py for python.

Thanks for your answer.

Re: How to run a Shell Script run from a search command?

woodcock — Wed, 12 Aug 2015 21:59:37 GMT

You need to change file = ./myscript.sh to filename = ./myscript.sh.

Re: How to run a Shell Script run from a search command?

SirHill17 — Thu, 13 Aug 2015 15:39:10 GMT

Correcting that I still got the same error message.

Checking the Splunk help:

| script
Makes calls to external Perl or Python programs

So I assume it is not possible to run shell script ? Anyone can confirm ?

Thanks!

Re: How to run a Shell Script run from a search command?

woodcock — Thu, 13 Aug 2015 16:17:32 GMT

The documentation is a bit vague so I am unsure. I always do perl and that works so you could always create a perl wrapper script to check.

Re: How to run a Shell Script run from a search command?

SirHill17 — Tue, 25 Aug 2015 13:45:34 GMT

It's finally not possible, I did Perl or Python and it works fine, so no shell. We will manage without 🙂

Re: How to run a Shell Script run from a search command?

woodcock — Fri, 17 Feb 2017 21:16:21 GMT

Please click Accept to close the question.

Re: How to run a Shell Script run from a search command?

cpm003 — Tue, 17 Sep 2019 15:42:37 GMT

you can create a python for call to os.system

shelllauncher.py
import os
os.system('./yourscript.sh')

commands.conf

[shelllauncher]
chunked=false
type=python
filename = shelllauncher.py

yourscript.sh
#!/bin/bash
ps aux

on splunk search:
| shelllauncher | table *

you might see "ps aux" linux command on results