Building for the Splunk Platform

Splunk script command

Raghav2384
Motivator

Hello Experts,

I am trying to pass an argument to a python script using "script command"

|gentimes start=-1|eval x=120|script python Hello $x$

throws me the following error (not sure how to make it an int from string on splunk side)

External search command 'Hello' returned error code 1.

If i try the following, it works as expected

|gentimes start=-1|eval x=120|script python Hello 120 -> Works

On the python side, if i say if sys.argv[1] > 100 elif sys.argv[1] < 100 (creates a message based on the condition) will always generate same message even when elif condition is true. I realized it's string and once i did int(sys.argv[1]) works on python side but not from splunk using $x$. Could you please shed some light?

Appreciate your help

Thanks,
Raghav

0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

|gentimes start=-1|eval x=120|map search="|gentimes start=-1 | script python Hello $x$"

View solution in original post

woodcock
Esteemed Legend

Try this:

|gentimes start=-1|eval x=120|map search="|gentimes start=-1 | script python Hello $x$"

Raghav2384
Motivator

you gotta be kidding me 🙂 that shed the exact amount of light i needed....Thank you

0 Karma

woodcock
Esteemed Legend

You can also do this with a subsearch but I am partial to map.

0 Karma

Raghav2384
Motivator

cool....I am able to pass the arguments to external script but the can't add this to triggered alert action as results are always 0 though there's value. I guess it passes the arguments and cleans itself out?

I run this |gentimes start=-1|eval x=120|map search="|gentimes start=-1 | script python Hello $x$"

I get the values of x printed to a text file but results say 0. If i could get the results populated so that they are displayed in triggered alerts & pass arguments that would solve it all. And i would drive to Texas and buy you a beer :)...is it possible?

0 Karma

woodcock
Esteemed Legend

Here is the way to do it with a subsearch:

  |gentimes start=-1|eval x=120|script python Hello [|gentimes start=-1|eval x=120 | return $x]
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...