Splunk Search

Custom Command Help

daniel333
Builder

All,

I am no developer and burned a couple hours on the making custom commands docs and conf sessions and feel like I am no closer. So hoping someone can give me a basic template to wrap this in?

Basically I have this script (works on python 2 and 3 unchanged). I'd like to pass my custom command a value which is a securitycode and return the value from my script. How can I get this done? Anyone have a template?

#!/usr/bin/env python3.5
import sys


hsh = [
     (1 , 'Known Violators'),
     (2 , 'Blocked Country'),
     (4 , 'Browser Integrity Check'),
     (8 , 'Known Violator User Agent'),
    (16 , 'Rate Limited'),
    (32 , 'Known Violator Honeypot Access'),
    (64 , 'Referrer Block'),
   (128 , 'Session Length Exceeded'),
   (256 , 'Pages Per Session Exceeded'),
   (512 , 'Bad User Agents'),
  (1024 , 'Aggregator User Agents'),
  (2048 , 'Filtered IP'),
  (4096 , 'JavaScript Not Loaded'),
  (8192 , 'JavaScript Check Failed'),
 (16384 , 'Identifier Validation Error'),
 (32768 , 'Known Violator Automation Tool'),
 (65536 , 'Form Spam Submission'),
(131072 , 'Unverified Signature'),
(262144 , 'IP Pinning Failure'),
(524288 , 'Invalid JavaScript Test Results'),
(1048576 , 'Organization Block'),
(2097152 , 'Known Violator Data Center'),
(4194304 , 'ACL User Agent'),
(8388608 , 'ACL ID'),
(16777216 , 'ACL Header'),
(134217728 , 'ACL Extension'),
(268435456 , 'Missing Unique ID'),
(536870912 , 'Requests Per Minute')
]

def help():
    print("threat_extract.py threat_number")

if __name__ == '__main__':
    if len(sys.argv) != 2:
        help()
        exit()

    threat_number = int(sys.argv[1])

    print(','.join([v for k, v in hsh if k & threat_number]))

gaurav_maniar
Builder

Hi,

Let's go step by step. (check the reference link, if you get stuck somewhere)
Ref 1 - http://docs.splunk.com/Documentation/SplunkCloud/7.0.5/Search/Customcommandlocation
Ref 2 - https://docs.splunk.com/Documentation/Splunk/7.2.0/Search/Customsearchcommandshape

As you are doing this for learning, I wont provide all the details. Following details will get you going.
If you need more help, you are welcome.

  1. Download Splunk Python SDK from the link, and copy 'splunklib' folder - http://dev.splunk.com/python
  2. Create an app with 'bin' and other required folders and paste the 'splunklib' folder inside bin folder
  3. Create commands.conf file inside default folder, with following configuration.

    [command_name]
    filename = python_file.py
    supports_rawargs = true

  4. Now create a python_file.pyinside 'bin' directory created at step 2. As details provided in reference 2, use the pre-defined code to capture command argument, process the results and push the new results/modified data by command back to Splunk.

  5. If python_file.py is using any other python file, than you have to import it with full path.

if this helps, don't forget to accept this answer.

cheers 🙂

0 Karma

maciep
Champion

To not answer your question, you could probably just use a lookup if this is all the command is going to do.

To ask a question, how would you envision this custom command working exactly? How would you want to use it in a search exactly?

0 Karma

daniel333
Builder

Thanks for replying.

I am kinda forcing this as a custom command as a learning opportunity, but hitting a wall. never done one, so thought I would use the excuse.

I am expecting to pass a value (a numeric field) from the log called vendorerrorcode.

mysearch | mycustomcommand vendorerrorcode

and get a returned field an array of all the possible error codes returned from the script above.

0 Karma

maciep
Champion

i haven't done with v2 of the sdk yet, but this does seem like a nice one to practice with. I may play with this when i have some free time. But for now, here are some thoughts.

At a high-level, i believe you'll want to create an app, put the sdk in the app, create your script in the app and create the commands.conf file to tell splunk about your script.

There is this searchcommands_app example in Splunk SDK repository. It has most of what you need to get started i think.

Then there is this section somewhere on the splunk dev site that explains what to do with that example app - where to put it and what else to put in there (some of the sdk bits).

For the code itself, i would probably base it off of this example in that app. It shows you how to make a streaming command, which basically what you're trying to do.

Not sure if any of that will help or just provide you more useless hours of reading. But if i do get a chance to play with this or if anyone else here has done something similar, hopefully we can get you a working example to get started with.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...