Getting Data In

External command calling subprocess not working

rdownie
Communicator

I am attempting to write an external command that uses a subprocess call and assigns the value returned by the subprocess call to a field and returns that in the output results. Like the many examples, if I set:

for r in results:
    r['foo']="bar"
si.outputResults(results)

works fine and gives me a fieldname of foo with a value of bar.


But when I try to assign the fieldname to what is returned from my subprocess call, it just creates the fieldname named the value and doesn't pass anything else back


Here is the code I am using, the ldapquery.py script returns a value "22393".

#import the python module provided with Splunk
import splunk.Intersplunk as si
import subprocess
import os

#read the results into a variable
results, dummyresults, settings = si.getOrganizedResults()

def getemp(host):
    emp = subprocess.call(["./ldapquery.py", host])
    return emp

#loop over each result. results is a list of dict.
for r in results:
    #r is a dict. Access fields using the fieldname.
    myhost = r['myhost']
    r['employee'] = getemp(myhost)
#return the results back to Splunk
si.outputResults(results)

Outputs "22393" as the name of the field and just gives it as a header.


the search I am using to test this is:


| stats count | eval myhost="bemsrv1" | hrdquery

the commands.conf file is.

[hrdquery]
filename = hrdquery.py
streaming = true
retainsevents = true

Any help with this would be greatly appreciated.


Thanks, Bob

Tags (1)
0 Karma

rdownie
Communicator

Support came back with this which works for shell and other python scripts but I can't get it to work with perl. It is a nice workaround for accessing python modules that are not part of splunk.


def getemp(host):
cmd = ("./mrilookup.pl ",host)
pseudohandle = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
stdout, stderr = pseudohandle.communicate()
return stdout.rstrip()

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...