Splunk Search

Custom command giving unexpected result

nadirriyani
New Member

I have followed below link but not receiving expected result.

Step 1
Commands.conf
[shape]
chunked=true
filename = shape.py
generating = true
supports_rawargs = true

Step 2
authorize.conf
[capability::run_script_first]
[role_admin]
run_script_first = enabled

Step 3
shape.py (in bin directory)
shape.py from below location.
https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Customsearchcommandshape

Step 4:
IImage attached
alt text

Step 5
expected result same as below link
https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Customsearchcommandshape

Query
1) How to send data from python to splunk? (splunk.Intersplunk.outputResults(results))
2) how to get result same as Step 5 link
3) is there any way, where as I may check that my python script is working properly? (any log or anywhere in UI)

OR
Share some custom command whereas I should be able to pass splunk data to receive data from python script???

Thanks in advance.

Tags (1)
0 Karma

Sukisen1981
Champion

Hi,
2 things can be tested here a bit further :
1-What happens if you run this command through CLI? something like $ splunk search "| shape. What output do you receive?
2- What happens if you run something like this from splunk web - index="main"|sourcetype="tutorial"|shape
3- you of course need to restart splunk enterprise after making the configuration changes

0 Karma

nadirriyani
New Member

Please find response
1)
Error in 'shape' command: You must provide a field argument.
The search job has failed due to an error. You may be able view the job in the Job Inspector.
2)
FATAL: Error in 'shape' command: You must provide a field argument.

3)I had already restarted splunk post changes in the configuration file.

I am using splunk enterprise 7.11 version

Have you run this example in your machine?
which splunk version are you using?
do I need to install any python lib?

0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...