Splunk Enterprise

Splunk custom command conflict with python requests

SaltyHash123
Explorer

Hey there, 
i have wrote a custom command in order to execute whois querys using an internal whois server,
which expects csv files and returns json files containing the results.
The CSVs are sent using HTTP posts. I have used pythons request module for this.
As the company policy leaves no room for internet connections, i have manually imported the module.
If i remove the http request (call of the getWhoisInfo), the code works perfectly fine and writes "Test" to each event into the newly generated column.
As soon as i execute the function and hence make the http post, there seems to be some kind of conflict with splunk. It results with the error  "The external search command 'whois' did not return events in descending time order, as expected."

Has anyone an idea or faced similar issues?
Thanks a lot in Advance 🙂 

 

#!/usr/bin/env python

import sys
import os
import csv
import pathlib
import json

script_path = os.path.realpath(__file__)

sys.path.append(os.path.join(script_path,"requests-2.25.1"))
sys.path.append(os.path.join(script_path,"splunklib"))


import requests
from splunklib.searchcommands import dispatch, EventingCommand, Configuration, Option, validators

csv_header = "Query"

def createCSV(header,data):
    with open(os.path.join(pathlib.Path(__file__).parent.absolute(),"..","tmp","whois_temp.csv"), "w+", newline='\n') as tmpcsv:
        wr = csv.writer(tmpcsv, quoting=csv.QUOTE_NONE)
        wr.writerow([csv_header])
        wr.writerows(data)
    return os.path.join(pathlib.Path(__file__).parent.absolute(),"..","tmp","whois_temp.csv")

def getWhoisInfo(csv_file):
    response = requests.post("http://[TargetHost]:[TargetPort]/whois", files={'file': open(csv_file, "r")},timeout=2)
    print(response.status_code)
    if response.status_code == 200:
        return response.text
    else:
        return None

@Configuration()
class whoisCommand(EventingCommand):
    """ %(synopsis)

    ##Syntax

    %(syntax)

    ##Description

    %(description)

    """
    fieldname = Option(
        doc='''
        **Syntax:** **fieldname=***<fieldname>*
        **Description:** Name of the field that will hold the whois results''',
        require=True, validate=validators.Fieldname())

    def transform(self, records):
        rec = list(records)
        data = [[record["hosts"]] for record in rec if record["hosts"] != ""]
        tmp_csv = createCSV(csv_header, data)
        whois_response = getWhoisInfo(tmp_csv)
        for record in rec:
            record[self.fieldname] = "TEST"
        return rec


if __name__ == "__main__":
    dispatch(whoisCommand, sys.argv, sys.stdin, sys.stdout, __name__)

 

 

SaltyHash123_0-1625584245679.png

PS: setting overrides_timeorder to true will not help

Labels (2)
0 Karma
1 Solution

SaltyHash123
Explorer

for those interested:
setting chunked = true in commands.conf will solve the issue 🙂

View solution in original post

0 Karma

SaltyHash123
Explorer

for those interested:
setting chunked = true in commands.conf will solve the issue 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...