I have a custom command that I call that populates a lookup but when I run the command, it only runs the script 5-20 times (it changes every time) while getting 20,000+ results. I'm wanting to run a query that sends the information into a custom script, to then populate a lookup, almost as if it's recursive. I'm thinking this is a performance issue of the script (it is a Python script so it's not the fastest). This is an example command of what it looks like:  index="*" host="example.org" | map search="| customcommand \"$src$\"" ... View more

I have a custom command that calls a script for nslookup and returns the data to splunk. All of it is working but I want to use this custom command in Splunk to return the data to an eval and output that into a table. For example, the search string would look something like the following:    index="*" | iplocation src_ip | eval testdata = | nslookupsearch dest_ip | table testdata _time | sort - _time   NOTE: This is not the exact search string, this is just a mock string. When I run:   | nslookupsearch Record_Here   I get the correct output and data that I want to see. But when I run the command to attach the returned value to an eval, it fails. I keep getting errors on doing this but I can't find something that will work like this. The testdata eval keeps failing.  ... View more

I'm trying to run personal scripts in Splunk from a dashboard. I want the dashboard to call a script by user input and then output the script to a table. I'm testing the ability with a Python script that calls a PowerShell script, returns the data to the Python script, and then returns the data to the Splunk dashboard. This is what I have so far:  Test_PowerShell.py Python Script:    import splunk.Intersplunk import sys import subprocess results,unused1,unused2 = splunk.Intersplunk.getOrganizedResults() # Define the path to the PowerShell script ps_script_path = "./Test.ps1" # Define the argument to pass to the PowerShell script argument = sys.argv[1] # Execute the PowerShell script with the argument results = subprocess.run(['powershell.exe', '-File', ps_script_path, argument], capture_output=True, text=True) splunk.Intersplunk.outputResults(results)   Page XML:    <form version="1.1" theme="dark"> <label>Compliance TEST</label> <description>TESTING</description> <fieldset submitButton="false" autoRun="false"></fieldset> <row> <panel> <title>Input Panel</title> <input type="text" token="user_input"> <label>User Input:</label> <default>*</default> </input> </panel> </row> <row> <panel> <title>Script Output</title> <table> <search> <query>| script python testps $user_input$ | table field1</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>   Test.ps1 PowerShell Script:    Write-Host $args[0]   commands.conf:   [testps] filename = Test_PowerShell.py streaming=true python.version = python3   default.meta   [commands/testps] access = read : [ * ], write : [ admin ] export = system [scripts/Test_PowerShell.py] access = read : [ * ], write : [ admin ] export = system   The error I'm getting is the following: External search command 'testps' returned error code 1.  ... View more

I have a PowerShell script that needs to be ran as admin to be able to load in all of the data. It returns a .csv file that exports to the lookups folder so that we can pull out the data and use said data. I have the script in the correct directory in the Splunk server and can see it and I can run it but I'm not getting data out of it which is making me think that the script is not being ran as an admin. I've tried a few things but can't get it to work correctly. I've come to a couple of different options for what to do here. 1. Make a managed service account that runs the script as an admin. 2. Try to configure splunkd to allow running as admin (if possible?) 3. Other recommendations? I'm relatively new to Splunk. Just trying to learn all I can and I appreciate any pointers/guidance.  ... View more

We got the email alert notifications running in Splunk and the configuration the same across all of the alerts but only some of them actually send an email. We have a separate page where we can see all of the alerts but we don't see all of them come across our emails. All of the alerts are configured the same way as seen below:  I'm not understanding why the email notifications only work for certain alerts when we can see all of the alerts on our dashboard and they're all configured the same.  ... View more