Splunk Dev

Custom whois command: Problem with passing keyword to function [Python]

stephan_berger
Explorer

Hello Splunk Community,

This is my small whois command:

import splunk.Intersplunk as si
import logging
import py_whois

def whois():
    host2,options = si.getKeywordsAndOptions()
    #host = "amazon.it"
    flags = 0
    nic_client = py_whois.NICClient()
    results = []
    result = nic_client.whois_lookup(None, host2, flags)
    lines = result.split('\n')
    for line in lines:
        results.append({"Whois Information for " + host : line})
    results.append({"Whois Information for " + host : line})
    #results.append({"hostname" : host2})
    return results

try: 
    results = whois()
except:
    import traceback
    stack =  traceback.format_exc()
    results = splunk.Intersplunk.generateErrorResults("Error : Traceback: " + str(stack))
si.outputResults( results )

I've got the code for the py_whois.NICClient class from here:

http://code.activestate.com/recipes/577364-whois-client/

Now, when I hardcode the host-string (i.e. amazon.it in the example above), the script works fine, but it fails when I pass the host-string I got as a keywords (getKeywordsAnd..). Do I need to convert the variable to another format before it can be passed to this function?

commands.conf

[swhois]

filename = swhois.py

Many thanks!

Best regards,
Stephan

0 Karma
1 Solution

stephan_berger
Explorer

Thanks for your help, Drainy, but I found the answer while looking at this thread:

Debugging custom splunk search command

args, kwargs = splunk.Intersplunk.getKeywordsAndOptions()
..
parameter1 = args[0]

ARGS is an array. I thought I have tested this as well.. nevermind, thanks again.

Best regards,
Stephan

View solution in original post

0 Karma

stephan_berger
Explorer

Thanks for your help, Drainy, but I found the answer while looking at this thread:

Debugging custom splunk search command

args, kwargs = splunk.Intersplunk.getKeywordsAndOptions()
..
parameter1 = args[0]

ARGS is an array. I thought I have tested this as well.. nevermind, thanks again.

Best regards,
Stephan

0 Karma

Drainy
Champion

Disclaimer, I haven't given your code above a test but my thoughts are...

Firstly, without looking at the intersplunk stuff again I couldn't say how it arrives but its probably safer to cast it as a string, do something like host=str(host2)

Secondly, I always find logging helpful in these situations, look up the Python logging module or just write to a file to keep a record of your variable values so you can see where things are going wrong.

http://docs.python.org/2/library/logging.html

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...