Getting Data In

Calling Python script from Front End

ashwath4k
Loves-to-Learn

Hi Everyone,

My business user has a requirement, he needs to run a python script from the SPLUNK web portal, the script is located in a windows server (Heavy forwarder).

Due to InfoSec policy, users are not allowed to RDP into the windows server,  so we need to find a way to call the python script from the front end. 

Script Background:

We will get logs from InfoSec which has URL dumps from the application gateway, SMTP gateway, and many other sources. The python script will read the URLS from the dum and create individual log files for each application (SMTP Gateway, Proxy Server, Web application gateway, Load balancer, etc..). Then the individual log files will be indexed through Splunk forwarder. The script needs to run every five hours like a scheduled job.

Challenge:

The terminal server in which the user will log in is already reporting to a different SPLUNK instance handled by the InfoSec team, so I cannot configure the SPLUNK universal forwarder in the terminal server to do the required job.

It will be helpful if you share some ideas on how to achieve it. Let me know if you need any additional details on this.

 

Thank you,

Ashwath Kumar R

 

 

0 Karma

anilchaithu
Builder

@ashwath4k 

 

You can create a scripted input from UI. I assume you have UI enabled on this HF. Please follow the below path to create the scripted input.

Settings -> Data Inputs -> Scripts -> New Local Script

anilchaithu_0-1628271375589.png

 

Fill the required parameters and save the input.

 

-- Hope this helps

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...