Splunk Search

How to run a Shell Script run from a search command?

SirHill17
Communicator

Hi,

I am trying to run a shell script from a search command. So I have created a shell script under $SPLUNK_HOME/etc/apps/myapp/bin/ and a specific commands.conf file with the below content:

[MYSCRIPT]
type = shell
file = ./myscript.sh

Running the following command on the search bar:

| script MYSCRIPT

I got an error message which is:

The type 'shell' for command 'MYSCRIPT' in commands.conf is invalid.

As per the doc, if I understand well, we can only use python or perl?

filename = "string"
    * Name of script file for command.
    * <script-name>.pl for perl.
    * <script-name>.py for python.

Thanks for your answer.

0 Karma
1 Solution

SirHill17
Communicator

It's finally not possible, I did Perl or Python and it works fine, so no shell. We will manage without 🙂

View solution in original post

0 Karma

SirHill17
Communicator

It's finally not possible, I did Perl or Python and it works fine, so no shell. We will manage without 🙂

0 Karma

woodcock
Esteemed Legend

Please click Accept to close the question.

0 Karma

woodcock
Esteemed Legend

You need to change file = ./myscript.sh to filename = ./myscript.sh.

0 Karma

SirHill17
Communicator

Correcting that I still got the same error message.

Checking the Splunk help:

| script
Makes calls to external Perl or Python programs

So I assume it is not possible to run shell script ? Anyone can confirm ?

Thanks!

0 Karma

woodcock
Esteemed Legend

The documentation is a bit vague so I am unsure. I always do perl and that works so you could always create a perl wrapper script to check.

cpm003
Path Finder

you can create a python for call to os.system

shelllauncher.py
import os
os.system('./yourscript.sh')

commands.conf

[shelllauncher]
chunked=false
type=python
filename = shelllauncher.py

yourscript.sh
#!/bin/bash
ps aux

on splunk search:
| shelllauncher | table *

you might see "ps aux" linux command on results

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...