I am attempting to write an external command that uses a subprocess call and assigns the value returned by the subprocess call to a field and returns that in the output results. Like the many examples, if I set:
for r in results:
r['foo']="bar"
si.outputResults(results)
works fine and gives me a fieldname of foo with a value of bar.
But when I try to assign the fieldname to what is returned from my subprocess call, it just creates the fieldname named the value and doesn't pass anything else back
Here is the code I am using, the ldapquery.py script returns a value "22393".
#import the python module provided with Splunk
import splunk.Intersplunk as si
import subprocess
import os
#read the results into a variable
results, dummyresults, settings = si.getOrganizedResults()
def getemp(host):
emp = subprocess.call(["./ldapquery.py", host])
return emp
#loop over each result. results is a list of dict.
for r in results:
#r is a dict. Access fields using the fieldname.
myhost = r['myhost']
r['employee'] = getemp(myhost)
#return the results back to Splunk
si.outputResults(results)
Outputs "22393" as the name of the field and just gives it as a header.
the search I am using to test this is:
| stats count | eval myhost="bemsrv1" | hrdquery
the commands.conf file is.
[hrdquery]
filename = hrdquery.py
streaming = true
retainsevents = true
Any help with this would be greatly appreciated.
Thanks, Bob
Support came back with this which works for shell and other python scripts but I can't get it to work with perl. It is a nice workaround for accessing python modules that are not part of splunk.
def getemp(host):
cmd = ("./mrilookup.pl ",host)
pseudohandle = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
stdout, stderr = pseudohandle.communicate()
return stdout.rstrip()