Splunk Dev

Modular input script execution

manudbc
Explorer

hello I have a modular input script which estract data from a external source with a interval ejecution this script has an Schema, I wont to use the schema data for a script ejecution in search
Modular input scheme script:

import json
import time
import urllib2

from splunklib.modularinput import *


class MyScript(Script):

    def get_scheme(self):

        scheme = Scheme("x")
        scheme.description = ("x")
        scheme.use_external_validation = True
        scheme.use_single_instance = False

        api_arg = Argument(
            name="api",
            title="API Code",
            data_type=Argument.data_type_string,
            required_on_create=True,
            required_on_edit=True
        )
        scheme.add_argument(api_arg)


        return scheme

    def validate_input(self, definition):
        api = definition.parameters["api"]

    def stream_events(self, inputs, ew):
            api = input_item["api"]
            list=[]
            count=0
            try:
                r = urllib2.Request("URLLLLLLL".format(api))
                t = json.loads(urllib2.urlopen(r).read())

                    logevent = Event()
                    logevent.stanza = input_name
                    logevent.data = json.dumps(t, sort_keys=True, separators=(',',':'))
                    ew.write_event(logevent)

if __name__ == "__main__":
    exitcode = MyScript().run(sys.argv)
    sys.exit(exitcode)

using following search

| script commandname arg1 arg2

my script use api schema data and update or add events to my index
¿any example of my script?

0 Karma

manudbc
Explorer

Is there any way to do that??

0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...