Splunk Search

Adding python script to search app

Path Finder

I have python script I want to add to the search app in splunk 5.0.3, I found some documentation: http://docs.splunk.com/Documentation/Splunk/5.0.3/Search/AddthecustomcommandtoSplunk

Now to make sure I am doing things correctly I copied the uniq.py and called it test.py and modified the commands.conf all in the $SPLUNK_HOME/etc/apps/search folder.

After restarting splunk I can see the script in: Manager > Advanced search > Search commands

However when I tried to use it I get an error:

Error in 'test' command: This command must be the first command of a search.

Meanwhile uniq work fine, obviously since that was built into splunk.

Thank you,

Brian

Tags (3)
0 Karma
1 Solution

Path Finder

Ok I was able to get my custom python script to work however I needed to do the following:

  1. Add my script to the $SPLUNK_HOME/etc/system/bin directory
  2. Modify the $SPLUNK_HOME/etc/system/default/transforms.conf to include the fields:

[myscript]
external_cmd = myscript.py InputField OutputField
fields_list = InputField OutputField

  1. Use my script as follows:

{My Search} |lookup myscript InputField as SearchField |table OutputField

Thank you,
Brian

View solution in original post

0 Karma

Path Finder

Ok I was able to get my custom python script to work however I needed to do the following:

  1. Add my script to the $SPLUNK_HOME/etc/system/bin directory
  2. Modify the $SPLUNK_HOME/etc/system/default/transforms.conf to include the fields:

[myscript]
external_cmd = myscript.py InputField OutputField
fields_list = InputField OutputField

  1. Use my script as follows:

{My Search} |lookup myscript InputField as SearchField |table OutputField

Thank you,
Brian

View solution in original post

0 Karma

Champion

How are you calling the command? Your search should have a leading pipe and your command being the first command; something like:

| test

Path Finder

Yes, when I do {my search} | uniq I get my expected results however when I do {my search} | test I get:

Error in 'test' command: This command must be the first command of a search.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!