Hi,
I created a custom search command following the instruction in the page and it was working fine (https://www.splunk.com/en_us/blog/tips-and-tricks/write-your-own-search-language.html)
however stopped working suddenly. Tried to put some file creation statement, the files are not created - looks the python program is not running at all.
Python code (C:\Program Files\Splunk\etc\apps\search\bin)
import splunk.Intersplunk
def getShape(text):
phrase1 = "upload"
phrase2 = "TrustedInstaller"
description = []
if (phrase1 in text):
description.append("Infra")
elif (phrase2 in text):
description.append("InstallationGroup")
else:
description.append("Misc")
Corpus = pd.read_csv(r"E:\corpus_single.csv",encoding='latin-1')
Corpus.to_csv(r'E:\corpus_func.csv', index = False)
if len(description) == 0
return "normal"
return "_".join(description)
# get the previous search results
results,unused1,unused2 = splunk.Intersplunk.getOrganizedResults()
Corpus = pd.read_csv(r"E:\corpus_single.csv",encoding='latin-1')
Corpus.to_csv(r'E:\corpus_out.csv', index = False)
# for each results, add a 'shape' attribute, calculated from the raw event text
for result in results:
result["assignmentgrp"] = getShape(result["Message"])
# output results
splunk.Intersplunk.outputResults(results)
---------
Entry in command.conf
(folder :C:\Program Files\Splunk\etc\apps\search\default)
[getgroup]
filename = getgroup.py
---------------
Search Query
source="winlog1.txt" | rex field=_raw "Message: <(?<Message>.*)>" | dedup Message | table Message, getgroup
--------
winlog1.txt sample data - having around 10 records
2016-09-28 04:30:31, Info Message: <Ending TrustedInstaller initialization.>
2016-09-28 04:30:31, Info Message: <Starting the TrustedInstaller main loop.>
2016-09-28 04:30:31, Info Message: <TrustedInstaller service starts successfully.>
2016-09-28 04:30:31, Info Message: <Initializing online with Windows opt-in: False.>
