Splunk Dev

Use an external script to pass values to search query

bxsplunkuser
New Member

We need to be able to use the results of an external command as inputs into a search query.

Specifically, we want to run a Python script that queries our AD and exclude the members of a group from search results. The Python script is all set but the integration into the query is confusing.

transforms.conf


[HRUserException]

external_cmd = my_script.py

external_type = python

Script output:

value1

value2

value3

How can we integrate this so that the output is used as a NOT condition? Script and output can be modified too.

Thanks!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Assuming your script results yield one event per excluded user with a user field set to its login, you can do this:

sourcetype=something NOT [HRUserException]

That will take the results of the subsearch, for example these events:

1: user=foo
2: user=bar
3: user=baz

and turn that into this search string:

( ( user="foo" ) OR ( user="bar" ) OR ( user="baz" ) )

The NOT in front of the subsearch will exclude those three users from the search, giving you this main search:

sourcetype=something NOT ( ( user="foo" ) OR ( user="bar" ) OR ( user="baz" ) )

If your external command results don't have a user field yet you may need to rex it out of the results first.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...