External command calling subprocess not working

[rdownie]

I am attempting to write an external command that uses a subprocess call and assigns the value returned by the subprocess call to a field and returns that in the output results. Like the many examples, if I set:

for r in results:
    r['foo']="bar"
si.outputResults(results)

works fine and gives me a fieldname of foo with a value of bar.

But when I try to assign the fieldname to what is returned from my subprocess call, it just creates the fieldname named the value and doesn't pass anything else back

Here is the code I am using, the ldapquery.py script returns a value "22393".

#import the python module provided with Splunk
import splunk.Intersplunk as si
import subprocess
import os

#read the results into a variable
results, dummyresults, settings = si.getOrganizedResults()

def getemp(host):
    emp = subprocess.call(["./ldapquery.py", host])
    return emp

#loop over each result. results is a list of dict.
for r in results:
    #r is a dict. Access fields using the fieldname.
    myhost = r['myhost']
    r['employee'] = getemp(myhost)
#return the results back to Splunk
si.outputResults(results)

Outputs "22393" as the name of the field and just gives it as a header.

the search I am using to test this is:

| stats count | eval myhost="bemsrv1" | hrdquery

the commands.conf file is.

[hrdquery]
filename = hrdquery.py
streaming = true
retainsevents = true

Any help with this would be greatly appreciated.

Thanks, Bob

[rdownie]

Support came back with this which works for shell and other python scripts but I can't get it to work with perl. It is a nice workaround for accessing python modules that are not part of splunk.

def getemp(host):
cmd = ("./mrilookup.pl ",host)
pseudohandle = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
stdout, stderr = pseudohandle.communicate()
return stdout.rstrip()