The import doent work. It gives error Unable to import DLL module ... View more

jrodman i would greatly appreciate if you could provide an example for your suggestion on tempfile as i am new to Python ... View more

Hi, make sure you have imported the csv library: import csv #for splunk batch input/output additional to this you need to add a loop to read each line and enrich each line and give it back into std output. here is a sample which reads the client ip, executes the method scorelookup and brings the values back. br matthias def main(): #print 'starte main' if len(sys.argv) != 3: print "Usage: python [ip field] [threatscore]" sys.exit(0) r = csv.reader(sys.stdin) w = csv.writer(sys.stdout) clientip = sys.argv[1] threatscore = sys.argv[2] header = [] first = True for line in r: if first: header = line if clientip not in header: print "IP field must exist in CSV data" sys.exit(0) csv.writer(sys.stdout).writerow(header) w = csv.DictWriter(sys.stdout, header) first = False continue # Read the result result = {} i = 0 while i < len(header): if i < len(line): result[header[i]] = line[i] else: result[header[i]] = '' i += 1 # Perform the lookup if len(result[clientip]): ts = scorelookup(result[clientip]) out = "%s,%s" % (result[clientip],ts) print out main() #f.close() ... View more

works great! Thanks! ... View more

LookUp Script NOT To Read from CSV File Yes i am looking for script which reads from the context of Splunk Searching instead of taking the input from CSV file from stdin Here is the script which works from standalone but not from context of splunk search # File namelookup.py # ------------------------------ import os,csv import sys import logging import logging.config import pyodbc FIELDS = [ "memberId", "memberName" ] # Given a id, find its name def lookupName(idf, cur): try: selString = "SELECT first_name FROM emp where Member_ID=" cur.execute (selString + idf ) row = cur.fetchone() return row[0] except: return [] def main(): if len(sys.argv) != 3: print "Usage: python name_lookup.py [id field] [name field]" sys.exit(0) idf = sys.argv[1] namef = sys.argv[2] # THIS IS NOT DESIRED #r = csv.reader(open('C:\\Splunk\\etc\\system\\bin\\memberInput.csv')) #r = csv.reader(sys.stdin) result = {} w = csv.DictWriter(sys.stdout, FIELDS) header = [] first = True conn = pyodbc.connect('DSN=IBM_DB') cursor = conn.cursor() if len( idf): result[namef] = lookupName(idf, cursor) print("Result of"+ namef) print(result[namef]) if len(result[namef]): w.writerow(result) cursor.close() conn.close() main() Pl let me know how to rewrite the script to read/write from the context of splun search ... View more

You might also want to look at M2Crypto for S/MIME, or write the body out to a file and call gpg directly from Python. You'll have to write some code, but this might help with ideas - http://stackoverflow.com/questions/1020320/how-to-do-pgp-in-python-generate-keys-encrypt-decrypt ... View more

any update on this? ... View more

I would title it troubleshooting lookup python script ... View more

Bansi how you made your lookup script running in Splunk? Im going mad.. ... View more

Suprisingly there are no concrete answers to my original posting. So i thought i would share my findings for the benefit of user community Here is the link if you are looking python extension DB2 module http://wiki.python.org/moin/ODBC But i am not sure which driver to use. I guess "pyodbc" i.e Python ODBC Library is open source but it doesnt have support for windows 64 bit OS for Python 2.6 version to run under Splunk provided Python runtime. So the other options are to go with commercial versions or try it with local install of Python version . But not sure again how to integrate it with Splunk environment. I wish their is sufficent documentation on Python Extension Modules like DB2 database to work under Splunk environment ... View more

Please see my first posting in which i have pasted XML Log file and exact search i.e. source="Test_Log.txt" | xmlkv entry | rex "(?i)<TransactionAttributes><entry key=\"CONTRACT_ID\">(? [^<]+)" | rex "(?i)<TransactionAttributes><entry key=\"CONTRACT_ID\">\w+<\/entry><entry key=\"MEMBER_ID\">(? [^<]+)" |where contractId="123" | mvexpand memberId |table contractId, memberId And as you suggested to append mvexpand memberId ... View more

Use the map command like this: source=source1 | dedup source1ID | map search="source=source2 source2ID=$source1ID$" ... View more

Please take a moment to answer the posting on http://answers.splunk.com/questions/9657/search-between-two-files-with-output-of-one-file-i-e-list-of-ids-passed-as-inp ... View more

Thank. I need one more help. I am stranded extracting "values" only from below xml % MALE VA I am expecting regex to give me output of values as: %, MALE, VA rex "(?ms)<SearchElements>(? .?)</SearchElements>" max_match=999 | rex field=abc max_match=50 "<entry key="."><(? [A-Za-z]+) "| eval keys=mvjoin(keys,",") | table abc Please take a moment to correct the regex ... View more

How would i remove duplicate keys in eval keys=mvjoin(keys,",") ... View more

You will need to write a regex that matches your format, or possibly use the xpatch commands. Take a look at the docs for reg and xpath. If you use rex, you may want to try out Kodos or RegexBuddy to help you troubleshoot your regular expression. ... View more

Well i did read the docs from the link you mentioned. Infact i used the link to do lookup using static table but i need dynamic lookup from database, thats where the link you provided doesnt have much information on how to configure DB2 drivers and sample lookup script (in Python for Java Developers) to extract values from database and put the results into search query. ... View more

Hi Ziegfried, Thanks for your response. I tried your rex command and the search result displays the values under those tag elements whereas my requirement is to extract tag names and not the values under those tag elements. Please note tag names are dynamic in nature i.e. one xml might have tag names : "Name DateOfBirth PhoneNo" whereas other xml might have tag names :"Gender Name PhoneNo" Once i retrieve the list of tag names under tag , i have to concatenate theses tag names with comma separated. For example my search query should return ouput as Name, DateOfBirth, PhoneNo ... View more

(2+ years later) there is now the Splunk DB Connect App: http://splunk-base.splunk.com/apps/50803/splunk-db-connect ... View more

I think if someone has already developed similar article to connect to DB2 database and lookup table at search time then please publish it otherwise i am working on it and will be glad to publish it if i get little help from Splunk Forums on how to integrate my working copy under Python 2.7 with Splunk Python 2.6 ... View more