How to pass values (dynamically derived from event) to a Python script as command line arguments?

[nikkkc]

Can I pass values (dynamically derived from event) to a Python script as command line arguments, do some magic in the script, and pass the new values back to Splunk? isp.outputResults(results)?

I tried this, but in the script, the argument is interpreted like a string. I mean the script knows just the name of the string, not the value!

[MuS]

Hi nikkkc,

take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.8/AdvancedDev/SearchScripts#Build_your_search_comman... to learn more about this topic. The important part is to import splunk.Intersplunk in your Python script, so the script can receive the results of the Splunk search and process them.

Here is an example of a script I use:

myresults,dummyresults,settings = splunk.Intersplunk.getOrganizedResults() # getting search results form Splunk
for r in myresults: # loop the results
    for k, v in r.items(): # get key value pairs for each result
        if k == "server": # get key
            section_name = v # set value

This will check the results passed by Splunk for a field called server and if found it uses its value.
At the end of the script it will return the output back to Splunk using this line:

 splunk.Intersplunk.outputResults(results) # print the result into Splunk UI

Hope this helps ...

cheers, MuS

[aab5272]

@MuS I used the same
results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults()
to grab the events from search results but it doesnt work ?

any ideas ?