Splunk Search

Adding python script to search app

bkirk
Path Finder

I have python script I want to add to the search app in splunk 5.0.3, I found some documentation: http://docs.splunk.com/Documentation/Splunk/5.0.3/Search/AddthecustomcommandtoSplunk

Now to make sure I am doing things correctly I copied the uniq.py and called it test.py and modified the commands.conf all in the $SPLUNK_HOME/etc/apps/search folder.

After restarting splunk I can see the script in: Manager > Advanced search > Search commands

However when I tried to use it I get an error:

Error in 'test' command: This command must be the first command of a search.

Meanwhile uniq work fine, obviously since that was built into splunk.

Thank you,

Brian

Tags (3)
0 Karma
1 Solution

bkirk
Path Finder

Ok I was able to get my custom python script to work however I needed to do the following:

  1. Add my script to the $SPLUNK_HOME/etc/system/bin directory
  2. Modify the $SPLUNK_HOME/etc/system/default/transforms.conf to include the fields:

[myscript]
external_cmd = myscript.py InputField OutputField
fields_list = InputField OutputField

  1. Use my script as follows:

{My Search} |lookup myscript InputField as SearchField |table OutputField

Thank you,
Brian

View solution in original post

0 Karma

bkirk
Path Finder

Ok I was able to get my custom python script to work however I needed to do the following:

  1. Add my script to the $SPLUNK_HOME/etc/system/bin directory
  2. Modify the $SPLUNK_HOME/etc/system/default/transforms.conf to include the fields:

[myscript]
external_cmd = myscript.py InputField OutputField
fields_list = InputField OutputField

  1. Use my script as follows:

{My Search} |lookup myscript InputField as SearchField |table OutputField

Thank you,
Brian

0 Karma

LukeMurphey
Champion

How are you calling the command? Your search should have a leading pipe and your command being the first command; something like:

| test

bkirk
Path Finder

Yes, when I do {my search} | uniq I get my expected results however when I do {my search} | test I get:

Error in 'test' command: This command must be the first command of a search.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...