how i write external_cmd python script

[zchandikaz]

I need to alter data in splunk using props.conf
I need to use external_cmd to run python script
Can you give me a example python script for that.

Thanks

[richgalloway]

Data in Splunk cannot be altered using props.conf or any other means.
Data arriving at Splunk can be modified using transforms.conf. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Data/Anonymizedata for an example.

See https://docs.splunk.com/Documentation/Splunk/8.0.3/Search/Writeasearchcommand for how to write an external command.

[zchandikaz]

Yes
Do you know alter data in transforms.conf using python program. I couldn't find a example to alter using python as i alter data using SEDCMD.

Thank you very much

[richgalloway]

If your python program is a scripted or modular input then you can make all the changes you like. It won't involve transforms.conf, however.
Or do you want to change the transforms.conf file itself using python? If so, I don't have an answer.

[zchandikaz]

No No
I simply want to mask some data using transforms.conf and props.conf. I know how to do it using SEDCMD or EVAL.But i need to consider more conditions before masking. So i need to use a python script to do it. But i don't know how to do it

Thanks

[richgalloway]

You seem to be contradicting yourself. You say you want to use transforms, but you don't want to use SEDCMD or EVAL, which are the methods offered by transforms. Like I said previously, a python script used as a modular or scripted input can make any alterations it wants to.
Perhaps you should describe what kind of data is involved, how it is being onboarded, and what it should look like in Splunk.

[zchandikaz]

simply i need to mask data in events
before masking i need to consider log level, logger and some conditions
So if i can write a script to mask, it'll be easy

[richgalloway]

Yes, a script can do that, but the data must be read by the script. It is not possible for a script to process data as it passes through an indexer.

[zchandikaz]

yes i'll find another alternative, thank you very much