Hello,
I've read through the documentation on external lookup with python and read through a few posts, could use some guidance. What I am trying to do is use this python script. Giving the script arguments protocol src_ip dest_ip src_port dest_port, gives you a calculated hash. Running it on its own works fine. This is what I've done so far:
Python script added to:
$SPLUNK_HOME/etc/apps/search/bin
Added stanza to transforms.conf:
[cid]
external_cmd = community-id.py Protocol SourceIp DestinationIp SourcePort DestinationPort
external_type = python
fields_list = Protocol, SourceIp, DestinationIp, SourcePort, DestinationPort
I've tried several examples of search commands that was in the documentation and what others have used, but haven't returned any results (errors). So im not really sure if I'm doing this correctly. I've noticed that some examples have their python scripts output to a .csv? is that necessary? should I approach this another way?
BLUF: I want to pass some fields into a python script to give me a calculated hash in a new field.
