Getting Data In

How to trigger script with arguments from Splunk search?

koshyk
Super Champion

I was able to make splunk send alert to my abc_pythonscript correctly after configuring commands.conf

| makeresults | eval myfield="some_raw_message" | table myfield| script abc_pythonscript myfield

But when I look into the arguments coming to my script, is myfield rather than the value within it. I was expecting the value of "some_raw_message" to be passed to my script.

Is it a mistake I'm doing or any better ways to do this?

1 Solution

woodcock
Esteemed Legend

Like this:

 | makeresults | eval myfield="some_raw_message" |map search="| makeresults | abc_pythonscript $myfield$"

View solution in original post

highsplunker
Contributor

This worked for me:

step 1. in search box of web interface
| makeresults | jonsnow dest="bbb", source="bla-bla-bla"

step 2. for "jonsnow" custom command to work
write this in commands.conf
[jonsnow]
filename = jonsnow.py

and this to local.meta of the same Splunk app

[commands/jonsnow]
access = read : [ * ], write : [ admin, power ]
export = system
owner = myusername

step 3. the script itself (jonsnow.py)
import splunk.Intersplunk
import subprocess
keywords, argvals = splunk.Intersplunk.getKeywordsAndOptions()
xxx = argvals['xxx']
yyy = argvals['yyy']
subprocess.call(["sh", "./jonsnow.sh", xxx, yyy])

0 Karma

vadivel_parames
Explorer

Hi Koshyk,

I have a similar requirement. Would be helpful if you could share the script how you are passing the splunk alert values into a python script.
Thanks!

woodcock
Esteemed Legend

You should really post a new question, but perhaps my (unaccepted) answer here helps?
https://answers.splunk.com/answers/41949/passing-search-results-to-external-python-script.html

0 Karma

koshyk
Super Champion

hi mate
1. create a python script (say my_python_script)
2. Ensure it has permissions to read from the app context
3. Run your base query and output results as you wish for your python script
4. and as answer given above pass those into a "map" command

0 Karma

woodcock
Esteemed Legend

Like this:

 | makeresults | eval myfield="some_raw_message" |map search="| makeresults | abc_pythonscript $myfield$"

highsplunker
Contributor

OK, worked too, thanks.
| makeresults | eval myfield="some_raw_message" |map search="| makeresults | abc_pythonscript $myfield$"

0 Karma

highsplunker
Contributor

Could you please share abc_pythonscript ?
See my answer below (worked).

0 Karma

koshyk
Super Champion

great thanks. worked like a charm

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...