Splunk Search

Custom command giving unexpected result

nadirriyani
New Member

I have followed below link but not receiving expected result.

Step 1
Commands.conf
[shape]
chunked=true
filename = shape.py
generating = true
supports_rawargs = true

Step 2
authorize.conf
[capability::run_script_first]
[role_admin]
run_script_first = enabled

Step 3
shape.py (in bin directory)
shape.py from below location.
https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Customsearchcommandshape

Step 4:
IImage attached
alt text

Step 5
expected result same as below link
https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Customsearchcommandshape

Query
1) How to send data from python to splunk? (splunk.Intersplunk.outputResults(results))
2) how to get result same as Step 5 link
3) is there any way, where as I may check that my python script is working properly? (any log or anywhere in UI)

OR
Share some custom command whereas I should be able to pass splunk data to receive data from python script???

Thanks in advance.

Tags (1)
0 Karma

Sukisen1981
Champion

Hi,
2 things can be tested here a bit further :
1-What happens if you run this command through CLI? something like $ splunk search "| shape. What output do you receive?
2- What happens if you run something like this from splunk web - index="main"|sourcetype="tutorial"|shape
3- you of course need to restart splunk enterprise after making the configuration changes

0 Karma

nadirriyani
New Member

Please find response
1)
Error in 'shape' command: You must provide a field argument.
The search job has failed due to an error. You may be able view the job in the Job Inspector.
2)
FATAL: Error in 'shape' command: You must provide a field argument.

3)I had already restarted splunk post changes in the configuration file.

I am using splunk enterprise 7.11 version

Have you run this example in your machine?
which splunk version are you using?
do I need to install any python lib?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...