I have followed below link but not receiving expected result.
Step 1
Commands.conf
[shape]
chunked=true
filename = shape.py
generating = true
supports_rawargs = true
Step 2
authorize.conf
[capability::run_script_first]
[role_admin]
run_script_first = enabled
Step 3
shape.py (in bin directory)
shape.py from below location.
https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Customsearchcommandshape
Step 4:
IImage attached
Step 5
expected result same as below link
https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Customsearchcommandshape
Query
1) How to send data from python to splunk? (splunk.Intersplunk.outputResults(results))
2) how to get result same as Step 5 link
3) is there any way, where as I may check that my python script is working properly? (any log or anywhere in UI)
OR
Share some custom command whereas I should be able to pass splunk data to receive data from python script???
Thanks in advance.
Hi,
2 things can be tested here a bit further :
1-What happens if you run this command through CLI? something like $ splunk search "| shape
. What output do you receive?
2- What happens if you run something like this from splunk web - index="main"|sourcetype="tutorial"|shape
3- you of course need to restart splunk enterprise after making the configuration changes
Please find response
1)
Error in 'shape' command: You must provide a field argument.
The search job has failed due to an error. You may be able view the job in the Job Inspector.
2)
FATAL: Error in 'shape' command: You must provide a field argument.
3)I had already restarted splunk post changes in the configuration file.
I am using splunk enterprise 7.11 version
Have you run this example in your machine?
which splunk version are you using?
do I need to install any python lib?