hello I have a modular input script which estract data from a external source with a interval ejecution this script has an Schema, I wont to use the schema data for a script ejecution in search Modular input scheme script: import json import time import urllib2 from splunklib.modularinput import * class MyScript(Script): def get_scheme(self): scheme = Scheme("x") scheme.description = ("x") scheme.use_external_validation = True scheme.use_single_instance = False api_arg = Argument( name="api", title="API Code", data_type=Argument.data_type_string, required_on_create=True, required_on_edit=True ) scheme.add_argument(api_arg) return scheme def validate_input(self, definition): api = definition.parameters["api"] def stream_events(self, inputs, ew): api = input_item["api"] list=[] count=0 try: r = urllib2.Request("URLLLLLLL".format(api)) t = json.loads(urllib2.urlopen(r).read()) logevent = Event() logevent.stanza = input_name logevent.data = json.dumps(t, sort_keys=True, separators=(',',':')) ew.write_event(logevent) if __name__ == "__main__": exitcode = MyScript().run(sys.argv) sys.exit(exitcode) using following search | script commandname arg1 arg2 my script use api schema data and update or add events to my index ¿any example of my script? ... View more

Hello, I was wondering if there is anyway to log data into Splunk using python SDK. I've found a way to send data to a specific port. In my case, I'm trying to log data into Splunk using a Python script calling it from Splunk search. Let me explain myself a little bit more: I perform a query that look like this: | script MyLogData parameter1 parameter2 That script make download a JSON file that I would like to log into Splunk. I have declared the script into commands.conf file so everything is fine. The file is executed successfully so there is no issue on that side. The problem is that I haven't find a way to log data into splunk using Python SDK. The only solution I've found is log data using a "remote" connection (using user and password), but is not the way I would like to do it due to the script is running on the Splunk server. My question is, Is there anyway to log data directly into Splunk? Does the SDK have anyway to do it? Thank you very much! Kind regards 🙂 ... View more

Hello, I want to change de X and Y axis in a table shown now: Desirable show: date:<value> date_hour:<value> date_mday:<value> date_minute:<value> date_month:<value> date_second:<value> date_wday:<value> date_year:<value> date_zone:<value> eventtype:<value> . . . ... View more