Building for the Splunk Platform

Use an external script to pass values to search query

New Member

We need to be able to use the results of an external command as inputs into a search query.

Specifically, we want to run a Python script that queries our AD and exclude the members of a group from search results. The Python script is all set but the integration into the query is confusing.



external_cmd =

external_type = python

Script output:




How can we integrate this so that the output is used as a NOT condition? Script and output can be modified too.


0 Karma


Assuming your script results yield one event per excluded user with a user field set to its login, you can do this:

sourcetype=something NOT [HRUserException]

That will take the results of the subsearch, for example these events:

1: user=foo
2: user=bar
3: user=baz

and turn that into this search string:

( ( user="foo" ) OR ( user="bar" ) OR ( user="baz" ) )

The NOT in front of the subsearch will exclude those three users from the search, giving you this main search:

sourcetype=something NOT ( ( user="foo" ) OR ( user="bar" ) OR ( user="baz" ) )

If your external command results don't have a user field yet you may need to rex it out of the results first.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...