Splunk Search

Python custom event generating commands to behave like macros

leecaf
Explorer

Given that macros lack the ability to take variable length arguments or parse a single arg into several args. what I'd like to do is create custom event generating commands in python that execute searches underneath the hood. a simple example would be a SQL 'in' syntax generator.

sqlIn( Id, 11, 33, 44 ) # where no of args can vary

would execute the search below and return the events in splunk UI or piped to subsequent commands.

index=* ( Id=11 OR Id=33 OR Id=44 )

The best way I can think of doing this is the create a event-generating command and execute the search via the rest API ( which seems clunky ) is there a way execute a search from the splunk search head calling this py script without having to infer the REST URL with env variables etc?

Even better

I'd like to be able to generate macro text from Python functions which when added to the /bin directory can be used like a normal macro.

Tags (2)
0 Karma

dart
Splunk Employee
Splunk Employee

You can do this using an macro with a subsearch.

If you create a search field in your subsearch it will expand out into a search, and you can use replace to format your string correctly, like so:

index=_internal metrics [ stats count | eval test="per_host_thruput,per_index_thruput" | eval search = "group=" + replace(test,",", " OR group=") ]

Which could be converted into a macro which specified the variable fields, and the field name.

You can also do this be creating a python script that returns a field called search, and then call it inside a subsearch.

yannK
Splunk Employee
Splunk Employee

You can create a custom search command calling a script.
see http://docs.splunk.com/Documentation/Splunk/5.0.3/Search/Writeasearchcommand

then have the script call a search using the REST API, or a simple the CLI search command.
for the CLI see http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CLIsearchsyntax

0 Karma

leecaf
Explorer

Think you've missed my point. I want to write a event generating command which will run a search and return some data from the splunk UI. not CLI specific.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...