Couldn't run script command

[EdSplunk]

Based on reference: http://www.splunk.com/base/Documentation/4.2/SearchReference/Script

I created a perl file that just outputs the arguments to a file. I called it test.pl and saved it under splunk_home/etc/searchscripts (I had to create the directory since it didn't exist).

I built my search

permit dst=192.* | stats count dst | script perl test.pl

but I keep getting an error:

Error in 'script' command: The external search command 'test.pl' does not exist in commands.conf.

Can anyone point me in the right direction?

[dwaddle]

Based on the error, your script needs to be defined in commands.conf, something similar to:

[test]
FILENAME = test.pl

See http://www.splunk.com/base/Documentation/latest/Admin/Commandsconf for details on commands.conf, and http://www.splunk.com/base/Documentation/latest/SearchReference/Aboutcustomsearchcommands for more details about defining your custom search command.

[echalex]

The error message certainly suggests you need to put this in commands.conf. However, the documentation for script doesn't mention that. Furthermore, having the script in commands.conf makes using the script command redundant.

[malbertdr]

I don't believe perl is currently supported. Only python.

[EdSplunk]

Actually, it is, based on the said reference.