How to execute a script and display results on a search page?

[tusharsaran1]

I need to execute a python script from Splunk search and display the return value on the same page. How can this be done?
I read about script command which allows us to pass an argument to an external script which has an entry in commands.conf. Does it also support displaying the values returned from this script?

[PowerPacked · Accepted solution]

Hi @tusharsaran1

Yes, you can do that

as you mentioned create a command which calls the python script, in the python script import the Intersplunk.py module which is availabale in $SplunkHome$/lib/python2.7/sitepackages/splunk.

This Intersplunk can do all the work for you, call the functions in the file like -- outputResults(),getOrganizedResults(),getKeywordsAndOptions()

in your case outputResults is the function which prints the results from python file to splunk UI.

Thanks

[tusharsaran1]

Thanks! This is exactly what I needed.
I wrote a quick script to test this and it worked !

[thambisetty]

Hi @tusharsaran1,

Please check out my app: https://splunkbase.splunk.com/app/3950/

[tusharsaran1]

I am not sure I understand how is this app similar to what I am looking for. Can you please explain exactly what your app does?

[thambisetty]

This app is used to check any email id is pwned or not in haveibeenpwned.com site.

Input - it takes any field contains email id and calls haveibeenpwened.com to query email id details and result will be parsed in python script and parsed result will be sent back to search.

please go through hipb.py in the TA. you will understand if you have coding background.

To understand more how this TA-works please read the description provided in splunkbase.