Splunk Dev

Splunk script command

Raghav2384
Motivator

Hello Experts,

I am trying to pass an argument to a python script using "script command"

|gentimes start=-1|eval x=120|script python Hello $x$

throws me the following error (not sure how to make it an int from string on splunk side)

External search command 'Hello' returned error code 1.

If i try the following, it works as expected

|gentimes start=-1|eval x=120|script python Hello 120 -> Works

On the python side, if i say if sys.argv[1] > 100 elif sys.argv[1] < 100 (creates a message based on the condition) will always generate same message even when elif condition is true. I realized it's string and once i did int(sys.argv[1]) works on python side but not from splunk using $x$. Could you please shed some light?

Appreciate your help

Thanks,
Raghav

0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

|gentimes start=-1|eval x=120|map search="|gentimes start=-1 | script python Hello $x$"

View solution in original post

woodcock
Esteemed Legend

Try this:

|gentimes start=-1|eval x=120|map search="|gentimes start=-1 | script python Hello $x$"

Raghav2384
Motivator

you gotta be kidding me 🙂 that shed the exact amount of light i needed....Thank you

0 Karma

woodcock
Esteemed Legend

You can also do this with a subsearch but I am partial to map.

0 Karma

Raghav2384
Motivator

cool....I am able to pass the arguments to external script but the can't add this to triggered alert action as results are always 0 though there's value. I guess it passes the arguments and cleans itself out?

I run this |gentimes start=-1|eval x=120|map search="|gentimes start=-1 | script python Hello $x$"

I get the values of x printed to a text file but results say 0. If i could get the results populated so that they are displayed in triggered alerts & pass arguments that would solve it all. And i would drive to Texas and buy you a beer :)...is it possible?

0 Karma

woodcock
Esteemed Legend

Here is the way to do it with a subsearch:

  |gentimes start=-1|eval x=120|script python Hello [|gentimes start=-1|eval x=120 | return $x]
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...