Splunk Search

Splunk Custom Search Command: Why is it showing up in configurations list, but not found from CLI?

tschn00
Explorer

I have written a python script whose purpose is to add a line to a file every time the specified command is called in Splunk. I created the script and added the command to the local commands.conf file.

When I go into my Splunk environment, I can see that this command is listed under the "Settings --> All Configurations"; However, when I try to run this command from the app, I get the following message: "Search Factory: Unknown search command 'printlog'."

Python Script (saved in \Splunk\etc\apps\search\bin)

import sys,splunk.Intersplunk
import datetime
results = []

try:
    results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults()
    now = datetime.datetime.now()
    with open('C:/testfile.txt','a') as openfile:
        openfile.write(str(now)+'\n')
    openfile.close()

except:
    import traceback
    stack =  traceback.format_exc()
    results = splunk.Intersplunk.generateErrorResults("Error : Traceback: " + str(stack))

splunk.Intersplunk.outputResults( results )

Commands.conf edit (saved in C:\Splunk\etc\apps\search\local)

[printLog]
filename = printLog.py
type = python
local = True
1 Solution

micahkemp
Champion

You have printLog in your commands.conf and printlog in your error message (capital L vs lowercase l). Is this perhaps a case of, well, case?

Adding to this answer after doing some testing.

I ran into the same issue when trying to define your search command as printLog, but it works when I make it printlog, including in commands.conf:

[printlog]
filename = printLog.py

I think search commands are actually case insensitive in the search bar, but they are all converted to lowercase to find the actual search command. So if you | WHERE, splunk looks for the search command where.

In addition to solving that issue, I strongly suggest you look at using the SDK for custom search commands instead of Intersplunk. This is advised by Splunk for new search commands. As a starting point, this snippet may accomplish what your script aims to do, but using the SDK:

printLog.py:

from splunklib.searchcommands import dispatch, EventingCommand, Configuration, Option
from splunklib.searchcommands.validators import Code

import sys 

@Configuration()
class PrintLogCommand(EventingCommand):
    def transform(self, records):
        now = datetime.datetime.now()
        with open('C:/testfile.txt','a') as openfile:
            openfile.write(str(now)+'\n')
        openfile.close()

        for record in records:
            yield record

dispatch(PrintLogCommand, sys.argv, sys.stdin, sys.stdout, __name__)

commands.conf:

[printlog]
filename = printLog.py
chunked = true

You would also need to copy splunklib from the python SDK into the bin directory for this to work.

View solution in original post

micahkemp
Champion

You have printLog in your commands.conf and printlog in your error message (capital L vs lowercase l). Is this perhaps a case of, well, case?

Adding to this answer after doing some testing.

I ran into the same issue when trying to define your search command as printLog, but it works when I make it printlog, including in commands.conf:

[printlog]
filename = printLog.py

I think search commands are actually case insensitive in the search bar, but they are all converted to lowercase to find the actual search command. So if you | WHERE, splunk looks for the search command where.

In addition to solving that issue, I strongly suggest you look at using the SDK for custom search commands instead of Intersplunk. This is advised by Splunk for new search commands. As a starting point, this snippet may accomplish what your script aims to do, but using the SDK:

printLog.py:

from splunklib.searchcommands import dispatch, EventingCommand, Configuration, Option
from splunklib.searchcommands.validators import Code

import sys 

@Configuration()
class PrintLogCommand(EventingCommand):
    def transform(self, records):
        now = datetime.datetime.now()
        with open('C:/testfile.txt','a') as openfile:
            openfile.write(str(now)+'\n')
        openfile.close()

        for record in records:
            yield record

dispatch(PrintLogCommand, sys.argv, sys.stdin, sys.stdout, __name__)

commands.conf:

[printlog]
filename = printLog.py
chunked = true

You would also need to copy splunklib from the python SDK into the bin directory for this to work.

tschn00
Explorer

I checked this, but it looks like no matter what case I use in the command line, the error message changes it to all lowercase. Did you notice any other mistakes in my method that might have caused this error?

0 Karma

tschn00
Explorer

Thank you so much. I experienced a different error once I fixed the first, but by using the python SDK method you suggested, it worked perfectly!

0 Karma

micahkemp
Champion

Updated answer after testing.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...