Archive

Splunk Custom Search Command: Why is it showing up in configurations list, but not found from CLI?

Explorer

I have written a python script whose purpose is to add a line to a file every time the specified command is called in Splunk. I created the script and added the command to the local commands.conf file.

When I go into my Splunk environment, I can see that this command is listed under the "Settings --> All Configurations"; However, when I try to run this command from the app, I get the following message: "Search Factory: Unknown search command 'printlog'."

Python Script (saved in \Splunk\etc\apps\search\bin)

import sys,splunk.Intersplunk
import datetime
results = []

try:
    results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults()
    now = datetime.datetime.now()
    with open('C:/testfile.txt','a') as openfile:
        openfile.write(str(now)+'\n')
    openfile.close()

except:
    import traceback
    stack =  traceback.format_exc()
    results = splunk.Intersplunk.generateErrorResults("Error : Traceback: " + str(stack))

splunk.Intersplunk.outputResults( results )

Commands.conf edit (saved in C:\Splunk\etc\apps\search\local)

[printLog]
filename = printLog.py
type = python
local = True
1 Solution

Champion

You have printLog in your commands.conf and printlog in your error message (capital L vs lowercase l). Is this perhaps a case of, well, case?

Adding to this answer after doing some testing.

I ran into the same issue when trying to define your search command as printLog, but it works when I make it printlog, including in commands.conf:

[printlog]
filename = printLog.py

I think search commands are actually case insensitive in the search bar, but they are all converted to lowercase to find the actual search command. So if you | WHERE, splunk looks for the search command where.

In addition to solving that issue, I strongly suggest you look at using the SDK for custom search commands instead of Intersplunk. This is advised by Splunk for new search commands. As a starting point, this snippet may accomplish what your script aims to do, but using the SDK:

printLog.py:

from splunklib.searchcommands import dispatch, EventingCommand, Configuration, Option
from splunklib.searchcommands.validators import Code

import sys 

@Configuration()
class PrintLogCommand(EventingCommand):
    def transform(self, records):
        now = datetime.datetime.now()
        with open('C:/testfile.txt','a') as openfile:
            openfile.write(str(now)+'\n')
        openfile.close()

        for record in records:
            yield record

dispatch(PrintLogCommand, sys.argv, sys.stdin, sys.stdout, __name__)

commands.conf:

[printlog]
filename = printLog.py
chunked = true

You would also need to copy splunklib from the python SDK into the bin directory for this to work.

View solution in original post

Champion

You have printLog in your commands.conf and printlog in your error message (capital L vs lowercase l). Is this perhaps a case of, well, case?

Adding to this answer after doing some testing.

I ran into the same issue when trying to define your search command as printLog, but it works when I make it printlog, including in commands.conf:

[printlog]
filename = printLog.py

I think search commands are actually case insensitive in the search bar, but they are all converted to lowercase to find the actual search command. So if you | WHERE, splunk looks for the search command where.

In addition to solving that issue, I strongly suggest you look at using the SDK for custom search commands instead of Intersplunk. This is advised by Splunk for new search commands. As a starting point, this snippet may accomplish what your script aims to do, but using the SDK:

printLog.py:

from splunklib.searchcommands import dispatch, EventingCommand, Configuration, Option
from splunklib.searchcommands.validators import Code

import sys 

@Configuration()
class PrintLogCommand(EventingCommand):
    def transform(self, records):
        now = datetime.datetime.now()
        with open('C:/testfile.txt','a') as openfile:
            openfile.write(str(now)+'\n')
        openfile.close()

        for record in records:
            yield record

dispatch(PrintLogCommand, sys.argv, sys.stdin, sys.stdout, __name__)

commands.conf:

[printlog]
filename = printLog.py
chunked = true

You would also need to copy splunklib from the python SDK into the bin directory for this to work.

View solution in original post

Explorer

I checked this, but it looks like no matter what case I use in the command line, the error message changes it to all lowercase. Did you notice any other mistakes in my method that might have caused this error?

0 Karma

Explorer

Thank you so much. I experienced a different error once I fixed the first, but by using the python SDK method you suggested, it worked perfectly!

0 Karma

Champion

Updated answer after testing.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!