Splunk Search

Custom command giving unexpected result

nadirriyani
New Member

I have followed below link but not receiving expected result.

Step 1
Commands.conf
[shape]
chunked=true
filename = shape.py
generating = true
supports_rawargs = true

Step 2
authorize.conf
[capability::run_script_first]
[role_admin]
run_script_first = enabled

Step 3
shape.py (in bin directory)
shape.py from below location.
https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Customsearchcommandshape

Step 4:
IImage attached
alt text

Step 5
expected result same as below link
https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Customsearchcommandshape

Query
1) How to send data from python to splunk? (splunk.Intersplunk.outputResults(results))
2) how to get result same as Step 5 link
3) is there any way, where as I may check that my python script is working properly? (any log or anywhere in UI)

OR
Share some custom command whereas I should be able to pass splunk data to receive data from python script???

Thanks in advance.

Tags (1)
0 Karma

Sukisen1981
Champion

Hi,
2 things can be tested here a bit further :
1-What happens if you run this command through CLI? something like $ splunk search "| shape. What output do you receive?
2- What happens if you run something like this from splunk web - index="main"|sourcetype="tutorial"|shape
3- you of course need to restart splunk enterprise after making the configuration changes

0 Karma

nadirriyani
New Member

Please find response
1)
Error in 'shape' command: You must provide a field argument.
The search job has failed due to an error. You may be able view the job in the Job Inspector.
2)
FATAL: Error in 'shape' command: You must provide a field argument.

3)I had already restarted splunk post changes in the configuration file.

I am using splunk enterprise 7.11 version

Have you run this example in your machine?
which splunk version are you using?
do I need to install any python lib?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...