Splunk Dev

How to pass values (dynamically derived from event) to a Python script as command line arguments?

nikkkc
Path Finder

Can I pass values (dynamically derived from event) to a Python script as command line arguments, do some magic in the script, and pass the new values back to Splunk? isp.outputResults(results)?

I tried this, but in the script, the argument is interpreted like a string. I mean the script knows just the name of the string, not the value!

0 Karma

MuS
Legend

Hi nikkkc,

take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.8/AdvancedDev/SearchScripts#Build_your_search_comman... to learn more about this topic. The important part is to import splunk.Intersplunk in your Python script, so the script can receive the results of the Splunk search and process them.

Here is an example of a script I use:

myresults,dummyresults,settings = splunk.Intersplunk.getOrganizedResults() # getting search results form Splunk
for r in myresults: # loop the results
    for k, v in r.items(): # get key value pairs for each result
        if k == "server": # get key
            section_name = v # set value

This will check the results passed by Splunk for a field called server and if found it uses its value.
At the end of the script it will return the output back to Splunk using this line:

 splunk.Intersplunk.outputResults(results) # print the result into Splunk UI

Hope this helps ...

cheers, MuS

0 Karma

aab5272
Engager

@MuS I used the same
results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults()
to grab the events from search results but it doesnt work ?

any ideas ?

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...