Splunk Search

Couldn't run script command

Explorer

Based on reference: http://www.splunk.com/base/Documentation/4.2/SearchReference/Script

I created a perl file that just outputs the arguments to a file. I called it test.pl and saved it under splunk_home/etc/searchscripts (I had to create the directory since it didn't exist).

I built my search

permit dst=192.* | stats count dst | script perl test.pl

but I keep getting an error:

Error in 'script' command: The external search command 'test.pl' does not exist in commands.conf.

Can anyone point me in the right direction?

Tags (3)

SplunkTrust
SplunkTrust

Based on the error, your script needs to be defined in commands.conf, something similar to:

[test]
FILENAME = test.pl

See http://www.splunk.com/base/Documentation/latest/Admin/Commandsconf for details on commands.conf, and http://www.splunk.com/base/Documentation/latest/SearchReference/Aboutcustomsearchcommands for more details about defining your custom search command.

Builder

The error message certainly suggests you need to put this in commands.conf. However, the documentation for script doesn't mention that. Furthermore, having the script in commands.conf makes using the script command redundant.

0 Karma

Explorer

I don't believe perl is currently supported. Only python.

0 Karma

Explorer

Actually, it is, based on the said reference.

0 Karma