Splunk Search

how to feed search result into "custom search command" and get output from custom search command?

muratogul
New Member

Hi,
I have written a custom search command to send whois queries for ip addresses that are resulted from search head. I assume that custom search command will get search result from search head and send them whois.arin.net then results will be listed in another field.

command.conf file includes following:

[whois]
chunked = true
filename = whois.py
generating = true
supports_rawargs = true
streaming = true
retainsevents = true #!!!!!!  not sure for this !!!!!!!!!!

code location:
C:\Program Files\Splunk\etc\system\bin
code snippet is also following, whole code is working properly out of Splunk, but dont get ant response when running on search head.

def whoisQuery(orgnames, settings):
    orgnames = []
    orgname = {}
............................................

if "OrgName" in i:
                b = i.split()
                orgname['OrgName'] = b[1:]
                orgnames.append(orgname)
                break
    except:
        pass

    return orgnames         

#to get previous search results     
orgnames, dummyresults, settings = splunk.Intersplunk.getOrganizedResults()     

#for result in orgnames:
orgnames = whoisQuery(orgnames, settings)
splunk.Intersplunk.outputResults(orgnames)
0 Karma

jkat54
SplunkTrust
SplunkTrust

Do this

results,unused1,unused2 = splunk.Intersplunk.getOrganizedResults()

And then orgnames=results[‘orgNamesField’]

In your getWhois function, don’t clobber the orgnames object. (orgnames=[] effectively wipes out what was passed to the function).

for result in results:
   orgnames=result[‘orgNamesField’]
   result[‘whoisResults’] = getWhois(orgnames)
splunk.Intersplunk.outputResults(results)
0 Karma

muratogul
New Member

thanks for response,
1. is already ok.
2. script run but no result or error, kind of infinite loop
3. yes I have two different script one of them is exactly from this sample even if it is not clear how search result being fed into script and how script results being returned to UI screen?

results,unused1,unused2 = splunk.Intersplunk.getOrganizedResults()

for result in results:
result["whois"] = whoisQuery(result["_raw"])
splunk.Intersplunk.outputResults(results)

0 Karma

MuS
Legend

this line results,unused1,unused2 = splunk.Intersplunk.getOrganizedResults() is reading the previous search results, and this line splunk.Intersplunk.outputResults(results) will output the results of your script into Splunk.

Maybe just start with the example, make that work and then start to change the script logic.

cheers, MuS

0 Karma

muratogul
New Member

thanks, make sense.

0 Karma

MuS
Legend

There are many things that can break here, so I just add a list of possible checks:

  1. Did you add import splunk.Intersplunk to your script?
  2. What happens if you start the script manually $SPLUNK_HOME/bi/splunk cmd python yourscritpnamehere.py any errors?
  3. Did you try the example from the docs http://docs.splunk.com/Documentation/Splunk/latest/Search/Customsearchcommandshape#Add_the_Python_sc... does that work?

cheers, MuS

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...