Splunk Search

How to run a Python script after search returns a value?

splunk_user4
Explorer

I am trying to get a Python script to run after a search returns a username.

The search returns one username after doing a few checks (works great).

The script will add a user to an AD group (works great).

My issue is now that run a script function is deprecated, and I can't find proper documentation about passing the event field into a Python argument to run.

My Python script is saved in $SPLUNK_HOME$/bin/scripts.

Labels (1)
0 Karma

chinmoya
Communicator

Splunk deprecated running scripts with alert actions. You can check that

OR
How about creating your own custom command.
The command can use the output of the search and pass it to the script.
You might need to change your script a bit to take in the input.

Below link can be helpful in creating a custom command
https://dev.splunk.com/enterprise/docs/developapps/customsearchcommands/

0 Karma

splunk_user4
Explorer

still not finding what I'm looking for in the custom search command, is what I'm asking usual for splunk to be able to do this?

0 Karma

cisconate
Engager

@splunk_user4  It is possible but very difficult by design of splunk.  When I worked for Northrup Grumman, I wrote a dashboard exactly like this that would display results about users and allow the "SOC" administrator to Enable, disable, or delete a user account on the fly.  

I do not recall the specifics of it now, but I will dig and try to find this data because it was certainly a labor of love at the time.   There was one specific scripting part where I had to dump the script output to "null" otherwise the script would hang.  Once I did that, we were able to execute python scripts using winRM to perform account actions.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...