Splunk Dev

Splunk SDK for Python: Why am I unable to access the top-level keys from outside of the orig_raw field within my adaptive response action?

zestep
New Member

I'm using the splunk SDK for python to create an adaptive response action!

My events are well-structured JSON objects - but from within my adaptive response ation I am not able to access the top-level keys from outside of the orig_raw field. Is this normal? How can I control this?

---code---

def do_genericevent(result):
        field = result.get(field_name)

--code--
I have some incoming JSON events like { "key" : "value" } but in the 'result' dictionary within my adaptive response action these are all shelved under "orig_raw". Is this normal?

0 Karma

starcher
SplunkTrust
SplunkTrust

You can save yourself a lot of pain if you use Splunk Add-on Builder from splunkbase to make custom alert actions/adaptive responses.

0 Karma

kchamplin_splun
Splunk Employee
Splunk Employee

Whats the rest of your code look like? Im interested in how you're instantiating your adaptive response class, as well as how you're creating the "result" object, as that should be generated from an unzip of the results file (per the example here: http://dev.splunk.com/view/enterprise-security/SP-CAAAFBH)

with gzip.open(modaction.results_file, 'rb') as fh:
                for num, result in enumerate(csv.DictReader(fh)):

zestep
New Member

The code works great. The result dictionary looks like { .... "orig_raw" : {my original json} } when I would prefer the original json to appear at the top level in the result-set. I think it's just a matter of configuring things correctly? What controls this?

0 Karma

zestep
New Member

session_key = modaction.session_key

    modaction.addinfo()
    ## process results
    if not os.path.exists(modaction.results_file):
        logger.info("No results available to process: %s does not exist, exiting." % modaction.results_file)
        sys.exit(0)
    with gzip.open(modaction.results_file, 'rb') as fh:
        for num, result in enumerate(csv.DictReader(fh)):
            ## set rid to row # (0->n) if unset
            result.setdefault('rid', str(num))

            modaction.update(result)
            modaction.invoke()

            act_result = modaction.dowork(result)

            if act_result:
                modaction.message('Successfully Changed Policy', status='success')
            else:
                modaction.message('Failed to change Policy', status='failure', level=logging.ERROR)

            modaction.writeevents(source='carbonblackdefenseapi')
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...