Splunk Search

Custom command giving unexpected result

nadirriyani
New Member

I have followed below link but not receiving expected result.

Step 1
Commands.conf
[shape]
chunked=true
filename = shape.py
generating = true
supports_rawargs = true

Step 2
authorize.conf
[capability::run_script_first]
[role_admin]
run_script_first = enabled

Step 3
shape.py (in bin directory)
shape.py from below location.
https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Customsearchcommandshape

Step 4:
IImage attached
alt text

Step 5
expected result same as below link
https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Customsearchcommandshape

Query
1) How to send data from python to splunk? (splunk.Intersplunk.outputResults(results))
2) how to get result same as Step 5 link
3) is there any way, where as I may check that my python script is working properly? (any log or anywhere in UI)

OR
Share some custom command whereas I should be able to pass splunk data to receive data from python script???

Thanks in advance.

Tags (1)
0 Karma

Sukisen1981
Champion

Hi,
2 things can be tested here a bit further :
1-What happens if you run this command through CLI? something like $ splunk search "| shape. What output do you receive?
2- What happens if you run something like this from splunk web - index="main"|sourcetype="tutorial"|shape
3- you of course need to restart splunk enterprise after making the configuration changes

0 Karma

nadirriyani
New Member

Please find response
1)
Error in 'shape' command: You must provide a field argument.
The search job has failed due to an error. You may be able view the job in the Job Inspector.
2)
FATAL: Error in 'shape' command: You must provide a field argument.

3)I had already restarted splunk post changes in the configuration file.

I am using splunk enterprise 7.11 version

Have you run this example in your machine?
which splunk version are you using?
do I need to install any python lib?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...