Getting Data In

Running external script from search

echalex
Builder

Hi,

I'm trying to generate events through an external script from the search, using the script command. Splunk says the command does not exist in commands.conf. However, the documentation for the script command doesn't say that the script needs to exist in commands.conf. Is this just a simple omission, or am I doing something wrong?

This is what I'm trying to do:

| script perl foo
Tags (2)
0 Karma
1 Solution

MHibbin
Influencer

I've not used the "script" command before, but I do use external scripts as custom commands. This involves setting up the "commands.conf" file.

Your script should live within the "bin" directory of your app, e.g. $SPLUNK_HOME/etc/apps/<appName>/bin/, you should then add something like the following to the app's "local" directory...

[exampleCommand]
filename = script.pl
type = perl

You can then call the script in Splunk like the following assuming you have 2 arguments.

*| exampleCommand arg1 arg2

View solution in original post

brettcarroll
Explorer

According to
the documentation for the script command you can't use script like you are thinking.

script calls an external python program that can modify or generate search results. Scripts must be declared in the commands.conf file and be located in the $SPLUNK_HOME/etc/apps//bin/ directory. The script is executed using $SPLUNK_HOME/bin/python

0 Karma

MHibbin
Influencer

I've not used the "script" command before, but I do use external scripts as custom commands. This involves setting up the "commands.conf" file.

Your script should live within the "bin" directory of your app, e.g. $SPLUNK_HOME/etc/apps/<appName>/bin/, you should then add something like the following to the app's "local" directory...

[exampleCommand]
filename = script.pl
type = perl

You can then call the script in Splunk like the following assuming you have 2 arguments.

*| exampleCommand arg1 arg2

MHibbin
Influencer

Sorry I couldn't help on the command itself, but good job on getting a solution working.

0 Karma

echalex
Builder

How the script command is supposed to be used is still a bit unclear to me, but editing commands.conf certainly works.

0 Karma

echalex
Builder

Hi,
Yes, this is pretty much what is described in the documentation about custom commands in the documentation. The documentation for the script command led me to believe you can avoid editing commands.conf.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...