Getting Data In

External command calling subprocess not working

rdownie
Communicator

I am attempting to write an external command that uses a subprocess call and assigns the value returned by the subprocess call to a field and returns that in the output results. Like the many examples, if I set:

for r in results:
    r['foo']="bar"
si.outputResults(results)

works fine and gives me a fieldname of foo with a value of bar.


But when I try to assign the fieldname to what is returned from my subprocess call, it just creates the fieldname named the value and doesn't pass anything else back


Here is the code I am using, the ldapquery.py script returns a value "22393".

#import the python module provided with Splunk
import splunk.Intersplunk as si
import subprocess
import os

#read the results into a variable
results, dummyresults, settings = si.getOrganizedResults()

def getemp(host):
    emp = subprocess.call(["./ldapquery.py", host])
    return emp

#loop over each result. results is a list of dict.
for r in results:
    #r is a dict. Access fields using the fieldname.
    myhost = r['myhost']
    r['employee'] = getemp(myhost)
#return the results back to Splunk
si.outputResults(results)

Outputs "22393" as the name of the field and just gives it as a header.


the search I am using to test this is:


| stats count | eval myhost="bemsrv1" | hrdquery

the commands.conf file is.

[hrdquery]
filename = hrdquery.py
streaming = true
retainsevents = true

Any help with this would be greatly appreciated.


Thanks, Bob

Tags (1)
0 Karma

rdownie
Communicator

Support came back with this which works for shell and other python scripts but I can't get it to work with perl. It is a nice workaround for accessing python modules that are not part of splunk.


def getemp(host):
cmd = ("./mrilookup.pl ",host)
pseudohandle = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
stdout, stderr = pseudohandle.communicate()
return stdout.rstrip()

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...