Splunk Dev

Use an external script to pass values to search query

bxsplunkuser
New Member

We need to be able to use the results of an external command as inputs into a search query.

Specifically, we want to run a Python script that queries our AD and exclude the members of a group from search results. The Python script is all set but the integration into the query is confusing.

transforms.conf


[HRUserException]

external_cmd = my_script.py

external_type = python

Script output:

value1

value2

value3

How can we integrate this so that the output is used as a NOT condition? Script and output can be modified too.

Thanks!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Assuming your script results yield one event per excluded user with a user field set to its login, you can do this:

sourcetype=something NOT [HRUserException]

That will take the results of the subsearch, for example these events:

1: user=foo
2: user=bar
3: user=baz

and turn that into this search string:

( ( user="foo" ) OR ( user="bar" ) OR ( user="baz" ) )

The NOT in front of the subsearch will exclude those three users from the search, giving you this main search:

sourcetype=something NOT ( ( user="foo" ) OR ( user="bar" ) OR ( user="baz" ) )

If your external command results don't have a user field yet you may need to rex it out of the results first.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...