Splunk Search

Custom Command Help



I am no developer and burned a couple hours on the making custom commands docs and conf sessions and feel like I am no closer. So hoping someone can give me a basic template to wrap this in?

Basically I have this script (works on python 2 and 3 unchanged). I'd like to pass my custom command a value which is a securitycode and return the value from my script. How can I get this done? Anyone have a template?

#!/usr/bin/env python3.5
import sys

hsh = [
     (1 , 'Known Violators'),
     (2 , 'Blocked Country'),
     (4 , 'Browser Integrity Check'),
     (8 , 'Known Violator User Agent'),
    (16 , 'Rate Limited'),
    (32 , 'Known Violator Honeypot Access'),
    (64 , 'Referrer Block'),
   (128 , 'Session Length Exceeded'),
   (256 , 'Pages Per Session Exceeded'),
   (512 , 'Bad User Agents'),
  (1024 , 'Aggregator User Agents'),
  (2048 , 'Filtered IP'),
  (4096 , 'JavaScript Not Loaded'),
  (8192 , 'JavaScript Check Failed'),
 (16384 , 'Identifier Validation Error'),
 (32768 , 'Known Violator Automation Tool'),
 (65536 , 'Form Spam Submission'),
(131072 , 'Unverified Signature'),
(262144 , 'IP Pinning Failure'),
(524288 , 'Invalid JavaScript Test Results'),
(1048576 , 'Organization Block'),
(2097152 , 'Known Violator Data Center'),
(4194304 , 'ACL User Agent'),
(8388608 , 'ACL ID'),
(16777216 , 'ACL Header'),
(134217728 , 'ACL Extension'),
(268435456 , 'Missing Unique ID'),
(536870912 , 'Requests Per Minute')

def help():
    print("threat_extract.py threat_number")

if __name__ == '__main__':
    if len(sys.argv) != 2:

    threat_number = int(sys.argv[1])

    print(','.join([v for k, v in hsh if k & threat_number]))



Let's go step by step. (check the reference link, if you get stuck somewhere)
Ref 1 - http://docs.splunk.com/Documentation/SplunkCloud/7.0.5/Search/Customcommandlocation
Ref 2 - https://docs.splunk.com/Documentation/Splunk/7.2.0/Search/Customsearchcommandshape

As you are doing this for learning, I wont provide all the details. Following details will get you going.
If you need more help, you are welcome.

  1. Download Splunk Python SDK from the link, and copy 'splunklib' folder - http://dev.splunk.com/python
  2. Create an app with 'bin' and other required folders and paste the 'splunklib' folder inside bin folder
  3. Create commands.conf file inside default folder, with following configuration.

    filename = python_file.py
    supports_rawargs = true

  4. Now create a python_file.pyinside 'bin' directory created at step 2. As details provided in reference 2, use the pre-defined code to capture command argument, process the results and push the new results/modified data by command back to Splunk.

  5. If python_file.py is using any other python file, than you have to import it with full path.

if this helps, don't forget to accept this answer.

cheers 🙂

0 Karma


To not answer your question, you could probably just use a lookup if this is all the command is going to do.

To ask a question, how would you envision this custom command working exactly? How would you want to use it in a search exactly?

0 Karma


Thanks for replying.

I am kinda forcing this as a custom command as a learning opportunity, but hitting a wall. never done one, so thought I would use the excuse.

I am expecting to pass a value (a numeric field) from the log called vendorerrorcode.

mysearch | mycustomcommand vendorerrorcode

and get a returned field an array of all the possible error codes returned from the script above.

0 Karma


i haven't done with v2 of the sdk yet, but this does seem like a nice one to practice with. I may play with this when i have some free time. But for now, here are some thoughts.

At a high-level, i believe you'll want to create an app, put the sdk in the app, create your script in the app and create the commands.conf file to tell splunk about your script.

There is this searchcommands_app example in Splunk SDK repository. It has most of what you need to get started i think.

Then there is this section somewhere on the splunk dev site that explains what to do with that example app - where to put it and what else to put in there (some of the sdk bits).

For the code itself, i would probably base it off of this example in that app. It shows you how to make a streaming command, which basically what you're trying to do.

Not sure if any of that will help or just provide you more useless hours of reading. But if i do get a chance to play with this or if anyone else here has done something similar, hopefully we can get you a working example to get started with.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...