Splunk Search

Using splunklib.modularinput without making a class

jwhughes58
Contributor

I've code that looks like this

#!/usr/bin/env python
#
#########################################################################
# Program    : verodin_get_jobs.py
# Purpose    :
# Programmer : Joe Hughes
#
#########################################################################

from __future__ import print_function

#########################################################################
# Imports for adding Splunk paths
#########################################################################
#
import os
import sys

sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "lib"))

#########################################################################
# Froms
#########################################################################
#
from splunklib.modularinput import *

#########################################################################
# Imports
#########################################################################
#
import json
import logging
import optparse
import re
import requests
import splunk.entity as entity
import time

try:
    from splunk.clilib.bundle_paths import make_splunkhome_path
except ImportError:
    from splunkappserver.mrsparkle.lib.util import make_splunkhome_path

formatter = logging.Formatter('%(asctime)s %(name)s: PID=%(process)s [%(threadName)s] %(levelname)s: - %(message)s', "%Y-%m-%d %H:%M:%S")
log = logging.getLogger('verodin_get_jobs')

#########################################################################
# Constants
#########################################################################
#

#########################################################################
# Globals
#########################################################################
#
USER='[email protected]'

#########################################################################
# Functions
#########################################################################

################
# getCredentials
################
#
def getCredentials(sessionKey, user):
    verodin = 'TA-kp_verodin'

    print(user, sessionKey)

    try:
      user=inputs.inputs.values()[0]['apiUser']
    except:
      log.error(" "+instance_name+" Unable to pull apiUser from inputs.conf, exiting")
      raise Exception(" Unable to pull apiUser from inputs.conf")

    try:
        entities = entity.getEntities(['admin', 'passwords'], namespace=verodin, owner='nobody', sessionKey=sessionKey)
    except Exception, e:
        raise Exception(" Could not get %s credentials from splunk. Error %s" % (verodin, str(e)))

    for i, c in entities.items():
        if c['username'] == user:
            return c['username'], c['clear_password']

    raise Exception(" No credentials found for user. Check that apiUser in inputs.conf matches the user in passwords.conf.")


###########
# main
###########
#
def main():
    print("Starting")
    sessionKey = _input_definition.metadata["session_key"]
    user = USER
    getCredentials(sessionKey, user)
    print("Ending")


#########################################################################
# Main Program
#########################################################################
#
if __name__ == '__main__':
    main()

What I haven't figured out how to do is call _input_definition.metadata["session_key"] without turning this into a class which I'm trying to avoid. I might be tripping up over python syntax. Any thoughts?

TIA,
Joe

0 Karma
1 Solution

jwhughes58
Contributor

From an email exchange with Splunk Development.

You’ve defined a scripted input, which is not compatible with the modular inputs framework - https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptedInputsIntro
The Splunk SDKs are not designed to work with scripted inputs, so we are not able to assist with questions about scripted inputs.
Please read the above and other documentation on docs.splunk.com.

And I also got this link which is the best explanation of why.

http://dev.splunk.com/view/python-sdk/SP-CAAAER3

View solution in original post

0 Karma

jwhughes58
Contributor

From an email exchange with Splunk Development.

You’ve defined a scripted input, which is not compatible with the modular inputs framework - https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/ScriptedInputsIntro
The Splunk SDKs are not designed to work with scripted inputs, so we are not able to assist with questions about scripted inputs.
Please read the above and other documentation on docs.splunk.com.

And I also got this link which is the best explanation of why.

http://dev.splunk.com/view/python-sdk/SP-CAAAER3

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How to Break a Kubernetes Pod on Purpose and Let the AI Troubleshooting Agent Find ...

Let's say I've just rolled out a Kubernetes Deployment with a typo in the image tag. Nothing explodes. The pod ...

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

The updated Splunk Add-on for Microsoft Windows helps customers search Windows events faster by reducing ...

What's New in Splunk Enterprise Security 8.8 and Beyond

Threats move at machine speed. Keeping up should not depend on having the biggest budget, the largest team, or ...