Dashboards & Visualizations

How to set up a Python script input and a dashboard that will search only the latest data generated by this script?

joyalonscreen
New Member

I would like to set up a Python script input which will output a .csv file. This .csv file will be the data input for my index.
Further, i would want the dashboard to search only the latest data generated by the script. Can you please guide me on how to go about this? I'm using a Windows machine and would prefer to use the Python interpreter present on my Windows machine.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You should develop your script using the python interpreter that ships with Splunk. That's the one that Splunk will use to run your script.
Have the script write the CSV file to your app's lookups directory ($SPLUNK_HOME/etc/apps//lookups). Then your searches can use the inputlookup command to get the data. One drawback to this approach is you will always have only the most recent data set - there's no going back in time to see how things changed.
Another approach is to have the script write the CSV file to a directory monitored by Splunk ([monitor:///path/to/file] in inputs.conf). That will give you a new set of data every time your script runs. Dashboard searches would then need to use an appropriate SPL command to fetch only the latest data. For example, if your script runs every hour, then the search could specify earliest=-1h to get only the last hour's data.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You should develop your script using the python interpreter that ships with Splunk. That's the one that Splunk will use to run your script.
Have the script write the CSV file to your app's lookups directory ($SPLUNK_HOME/etc/apps//lookups). Then your searches can use the inputlookup command to get the data. One drawback to this approach is you will always have only the most recent data set - there's no going back in time to see how things changed.
Another approach is to have the script write the CSV file to a directory monitored by Splunk ([monitor:///path/to/file] in inputs.conf). That will give you a new set of data every time your script runs. Dashboard searches would then need to use an appropriate SPL command to fetch only the latest data. For example, if your script runs every hour, then the search could specify earliest=-1h to get only the last hour's data.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...