Splunk Search

Python custom event generating commands to behave like macros

leecaf
Explorer

Given that macros lack the ability to take variable length arguments or parse a single arg into several args. what I'd like to do is create custom event generating commands in python that execute searches underneath the hood. a simple example would be a SQL 'in' syntax generator.

sqlIn( Id, 11, 33, 44 ) # where no of args can vary

would execute the search below and return the events in splunk UI or piped to subsequent commands.

index=* ( Id=11 OR Id=33 OR Id=44 )

The best way I can think of doing this is the create a event-generating command and execute the search via the rest API ( which seems clunky ) is there a way execute a search from the splunk search head calling this py script without having to infer the REST URL with env variables etc?

Even better

I'd like to be able to generate macro text from Python functions which when added to the /bin directory can be used like a normal macro.

Tags (2)
0 Karma

dart
Splunk Employee
Splunk Employee

You can do this using an macro with a subsearch.

If you create a search field in your subsearch it will expand out into a search, and you can use replace to format your string correctly, like so:

index=_internal metrics [ stats count | eval test="per_host_thruput,per_index_thruput" | eval search = "group=" + replace(test,",", " OR group=") ]

Which could be converted into a macro which specified the variable fields, and the field name.

You can also do this be creating a python script that returns a field called search, and then call it inside a subsearch.

yannK
Splunk Employee
Splunk Employee

You can create a custom search command calling a script.
see http://docs.splunk.com/Documentation/Splunk/5.0.3/Search/Writeasearchcommand

then have the script call a search using the REST API, or a simple the CLI search command.
for the CLI see http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CLIsearchsyntax

0 Karma

leecaf
Explorer

Think you've missed my point. I want to write a event generating command which will run a search and return some data from the splunk UI. not CLI specific.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...