Purpose: Help the reader understand one approach to have Splunk kick-off a Python script that returns data to Splunk without indexing returned data, or modifying the Slunk Python installation.
Use Case: Splunk ships with a minimal implementation of Python 2.7. If you need to utilize a module that isn’t installed with the Splunk implementation it is recommended that an installation external to Splunk, with the modules installed, be used.
Expected Action: The user will initiate a Splunk search query using a custom command. This custom command will initiate a wrapper python script that will read a passed parameter/argument and initiate the target python script and return the values to the Slunk interface for display or use.
(Note: this is Splunk Enterprise on Windows Server)
Python Needs:
- Python Installation (external to Splunk Python installation) -Full Python or Virtual Environment.
- Install your required modules into your python environment (pip or other installation tool)
- Note the Python executable locations -Splunk Python location: (e.g. D:\Splunk\bin\python.exe) -External Python installation (e.g. D:\Splunk_Python_venv\p27_15\Scripts\python.exe)
Script Requirements:
1. Wrapper script: (see example_wrapper.py)
-Will work with Splunk python implementation. (No modules added outside of Splunk standard installation)
-Reference Intersplunk class
sys.path.append("/Splunk/Python-2.7/Lib/site-packages/splunk")
import Intersplunk
-Print output results from target script
2. Target script: (see example_target.py)
-Can use your modules or customizations
-Reference Intersplunk class
sys.path.append("/Splunk/Python-2.7/Lib/site-packages/splunk")
import Intersplunk
-Call Intersplunk.outputResults(results)
(results) is your result set and it must be in a format that can be consumed by Splunk.
Splunk Custom Search Command:
1. Create custom search command in commands.conf
[activatepython]
chuncked = false
filename = example_wrapper.py
Run Script from commandline:
\Splunk\etc\apps\myapp\bin>........\bin\splunk cmd python example_wrapper.py scripttarget=example_target.py
Run Script from SPL
Example Files:
######################################################################################
############### following is the example_wrapper.py file #############################
######################################################################################
import os
import subprocess
import re
import sys
sys.path.append("/Splunk/Python-2.7/Lib/site-packages/splunk")
import Intersplunk
custompythonpath = 'D:\Splunk_Python_venv\p27_15\Scripts\python.exe'
splunkpythonpath = 'D:\Splunk\bin\python.exe'
os.environ['PYTHONPATH'] = custompythonpath
# from splunk web interface this is needed to get the arguments
# example SPL "| scriptwrapper scripttarget=example_target.py"
keywords, argvals = Intersplunk.getKeywordsAndOptions()
try:
#pull in the arguments
scripttarget = argvals['scripttarget']
#prevent code injection: verify we aren't getting a file outside of our run directory
fileVerify=re.split('/|\*|\\\\|\'|\"', scripttarget)
if os.path.isfile(fileVerify[0]):
#create full path to your script
my_process = os.path.join(os.getcwd(), scripttarget)
#create subprocess be sure to pass stdin, stdout, stderr
p = subprocess.Popen([custompythonpath, my_process, splunkpythonpath], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
# get the output
output = p.communicate()[0]
# push it out
print output
else:
print ('Unable to verify requested action'.format(fileVerify))
except Exception as e:
print(e)
######################################################################################
############### following is the example_target.py file #############################
######################################################################################
# pypyodbc has a dependency on environment variable 'windir' be sure
# if using the the activate process that the class passes in the evirnoment variable on activate.
import sys
import pypyodbc
import sys
import os
sys.path.append("/Splunk/Python-2.7/Lib/site-packages/splunk")
import Intersplunk
def GetSqlResults(connectionString, sqlText):
results = []
try:
db = pypyodbc.connect(connectionString)
cursor = db.cursor()
cursor.execute(sqlText)
columns = [column[0] for column in cursor.description]
#had to do the following to get splunk to accept the result set (I thought this would be simpler)
for row in cursor.fetchall():
result = {}
for column in columns:
result[column] = row[column]
results.append(result)
db.close()
except Exception as e:
print('Bad things happened when executing SQL: {0}'.format(e))
return results
if __name__ == "__main__":
connectionString = "Trusted_Connection=yes; Driver={SQL Server};server=greatstuffserver;database=greatstuffdatabase'
sqlText = 'select id, name from greatstufftable'
results = []
results = GetSqlResults(connectionString, sqlText)
#send results to Intersplunk (the wrapper class will 'print' the output)
Intersplunk.outputResults(results)
sys.exit(0)
