Based on reference: http://www.splunk.com/base/Documentation/4.2/SearchReference/Script
I created a perl file that just outputs the arguments to a file. I called it test.pl and saved it under splunk_home/etc/searchscripts (I had to create the directory since it didn't exist).
I built my search
permit dst=192.* | stats count dst | script perl test.pl
but I keep getting an error:
Error in 'script' command: The external search command 'test.pl' does not exist in commands.conf.
Can anyone point me in the right direction?
Based on the error, your script needs to be defined in
commands.conf, something similar to:
[test] FILENAME = test.pl
See http://www.splunk.com/base/Documentation/latest/Admin/Commandsconf for details on
commands.conf, and http://www.splunk.com/base/Documentation/latest/SearchReference/Aboutcustomsearchcommands for more details about defining your custom search command.
The error message certainly suggests you need to put this in commands.conf. However, the documentation for
script doesn't mention that. Furthermore, having the script in commands.conf makes using the
script command redundant.