Splunk Dev

How to write and execute python script for XML file ?

adityaanand
Explorer

Hi,
I have to monitor a directory which contains XML file.
I need to add an additional <tag> in xml file whenever a new file comes and before file is indexed by splunk.
i.e. whenever a file come a script should be run that add a <tag>. Then after it is indexed.
How can achieve through python script?
Is anything required to install to run the script?

XML File look like :

<?xml version="1.0" encoding="utf-8"?>
    <presentation>
      <lesson>
        <part src="0301p.flv" breadcrumb="This is example text1">
          <cuepoints>
            <cuepoint time="0:01" preload="priority" tooltip="Demo 3.1(A)" jumpable="yes">
              <tween mode="instant" time="1" />
              <slide flv="demos/0301d1.flv" demooffsetx="-180" demooffsety="60" type="demo"></slide>
              <presenter />
              <controls />
            </cuepoint>
          </cuepoints>
         </part>
       </lesson>
    </presentation>

      I need to add  <date>...</date> just below <presentation> tag.

I have no idea how will i proceed?

Regards,
Aditya

Tags (2)
0 Karma

koshyk
Super Champion

You can write python script, but I wouldn't tie it to Splunk Index process. You need to tie it to the Process/script which puts the file in there.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Writing the script is straightforward. Create it as you would any stand-alone python program with the understanding that everything written to stdout will be indexed by Splunk. You could have the script read a file line-by-line and write the lines to stdout with your extra line added at the proper place.

I don't know how to have the script execute whenever a new file arrives. The best I can think of is to create a scripted input that runs at some interval and have the script search for new files that have arrived since the last interval.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...