Splunk Enterprise

Splunk custom command conflict with python requests


Hey there, 
i have wrote a custom command in order to execute whois querys using an internal whois server,
which expects csv files and returns json files containing the results.
The CSVs are sent using HTTP posts. I have used pythons request module for this.
As the company policy leaves no room for internet connections, i have manually imported the module.
If i remove the http request (call of the getWhoisInfo), the code works perfectly fine and writes "Test" to each event into the newly generated column.
As soon as i execute the function and hence make the http post, there seems to be some kind of conflict with splunk. It results with the error  "The external search command 'whois' did not return events in descending time order, as expected."

Has anyone an idea or faced similar issues?
Thanks a lot in Advance 🙂 


#!/usr/bin/env python

import sys
import os
import csv
import pathlib
import json

script_path = os.path.realpath(__file__)


import requests
from splunklib.searchcommands import dispatch, EventingCommand, Configuration, Option, validators

csv_header = "Query"

def createCSV(header,data):
    with open(os.path.join(pathlib.Path(__file__).parent.absolute(),"..","tmp","whois_temp.csv"), "w+", newline='\n') as tmpcsv:
        wr = csv.writer(tmpcsv, quoting=csv.QUOTE_NONE)
    return os.path.join(pathlib.Path(__file__).parent.absolute(),"..","tmp","whois_temp.csv")

def getWhoisInfo(csv_file):
    response = requests.post("http://[TargetHost]:[TargetPort]/whois", files={'file': open(csv_file, "r")},timeout=2)
    if response.status_code == 200:
        return response.text
        return None

class whoisCommand(EventingCommand):
    """ %(synopsis)





    fieldname = Option(
        **Syntax:** **fieldname=***<fieldname>*
        **Description:** Name of the field that will hold the whois results''',
        require=True, validate=validators.Fieldname())

    def transform(self, records):
        rec = list(records)
        data = [[record["hosts"]] for record in rec if record["hosts"] != ""]
        tmp_csv = createCSV(csv_header, data)
        whois_response = getWhoisInfo(tmp_csv)
        for record in rec:
            record[self.fieldname] = "TEST"
        return rec

if __name__ == "__main__":
    dispatch(whoisCommand, sys.argv, sys.stdin, sys.stdout, __name__)




PS: setting overrides_timeorder to true will not help

Labels (2)
0 Karma
1 Solution


for those interested:
setting chunked = true in commands.conf will solve the issue 🙂

View solution in original post

0 Karma


for those interested:
setting chunked = true in commands.conf will solve the issue 🙂

0 Karma