I created a custom search command called myformula.py. When I run the script in my command prompt, everything works fine. Then I run it in Splunk search bar, it shows "External search command 'myformula' returned error code 1".
I tried to check what is the exact error with below command:
index=_internal sourcetype=splunkd ExecProcessor
But I just get nothing. Does anybody know how to view the stdout or stdin message in Splunk? Please help.
Are you utilizing python that comes with the OS or the one that comes with Splunk? Try running your script like this:
$SPLUNK_HOME/bin/splunk cmd python my_formula.py
This should run it with the Splunk python distribution.
Thanks for your answer. My first line of script is
results,unused1,unused2 = splunk.Intersplunk.getOrganizedResults()
The script should get the search results before proceed:
index=myindex | myformula
May I know how can I pass the search results through command above? I tried below command and it is not working also:
splunk search "index=myindex | myformula"
try: : except: import traceback stack = traceback.format_exc() results = splunk.Intersplunk.generateErrorResults("Error : Traceback: " + str(stack))