Getting Data In

External lookup command in Windows


I have an external lookup script (written in python) that uses the pymssql module to query a SQL Server 2005 database. The script works with a 32bit python interpreter but my splunk instances are all running on Windows x64 and pymssql won't run with a 64bit python so I'm a bit hosed.

As I see it, I have two options:

  • I can specify that splunk use a python interpreter other than the one it ships with
  • Find another way to query a Microsoft SQL server from the built-in python

I have no idea how to go about accomplishing either. Has anyone figured out how to query a SQL Server 2005 database from an external lookup script on x64?

Tags (1)

Path Finder

Jason, As per your suggestion if i copy files from PyODBC, 64-bit windows build i.e. Python\lib\site-packages, to $SPLUNK_HOME\lib\Python2.6\site-packages.

Would i be able to call external database lookup script from Splunk? Or i need to do more tweaks?

Please note i have database lookup script written using Python 2.7 because pyodbc has 64 bit wndows installation only for Python 2.7 and not for Python 2.6

So now i am looking for steps to integrate my script with Splunk

0 Karma


You could use PyODBC, which has a 64-bit windows build. It looks like it installs only a few files into Python\lib\site-packages, which could probably be copied into $SPLUNK_HOME\lib\Python2.6\site-packages

0 Karma

Splunk Employee
Splunk Employee

I think you want to just run the external python interpreter.

Something like this, treat as pseudocode.

import os, sys

if "PYTHONPATH" in os.environ:
    del os.environ["PYTHONPATH"]
if "LD_LIBRARY_PATH" in os.environ:
    del os.environ["LD_LIBRARY_PATH"]

os.execv(your_python_interpreter, [your_python_interpreter, your_script] + sys.argv[1:])

Splunk Employee
Splunk Employee

When I wrote this i probably should have mentioned that you are likely to want to manipulate the PATH environment variable, to select which will win when running additional commands between system binaries, splunk-provided binaries and any custom binaries (eg in usr/local or special paths) in case of name conflict.

This is typically relevant for bzip2, python itself, cherryd, the openssl utility program, node.js's node executable, but but more executables could possibly be added to splunk in the future.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...