SPLUNK-CREATING-CUSTOM-COMMANDS-USING-PYTHON


SPLUNK

docker-compose exec splunk bash

sudo ls -l etc/apps/sreeapp/bin/
total 4
-rw-r--r-- 1 splunk splunk 63 Nov  5 14:44 README

[ansible@02eb9ca7dbc0 splunk]$ sudo pip install -t etc/apps/sreeapp/bin splunk-sdk

sudo ls -l etc/apps/sreeapp/bin/
total 44
-rw-r--r-- 1 splunk splunk    63 Nov  5 14:44 README
drwxr-xr-x 2 root   root    4096 Nov  5 14:46 __pycache__
drwxr-xr-x 2 root   root    4096 Nov  5 14:46 deprecation-2.1.0.dist-info
-rw-r--r-- 1 root   root   12895 Nov  5 14:46 deprecation.py
drwxr-xr-x 3 root   root    4096 Nov  5 14:46 packaging
drwxr-xr-x 2 root   root    4096 Nov  5 14:46 packaging-24.1.dist-info
drwxr-xr-x 2 root   root    4096 Nov  5 14:46 splunk_sdk-2.1.0.dist-info
drwxr-xr-x 5 root   root    4096 Nov  5 14:46 splunklib

BOX
docker-compose exec box bash
apt update
apt install tree nano -y
nano /opt/splunk/etc/apps/sreeapp/bin/sreeapp.py
 
import sys
from splunklib.searchcommands import dispatch, StreamingCommand, Configuration
@Configuration()
class SreeApp(StreamingCommand):
  def stream(self, records):
    for record in records:
      record['sree_hello']='world ' + record['host']
      yield record
if __name__ == "__main__":
  dispatch(SreeApp, sys.argv, sys.stdin, sys.stdout, __name__)

nano /opt/splunk/etc/apps/sreeapp/default/commands.conf  
[sreeapp]
chunked=true
filename=sreeapp.py
 
chown -R 41812.41812 /opt/splunk/etc/apps/sreeapp
chmod -R 777 /opt/splunk/etc/apps/sreeapp

SPLUNK
======
docker-compose exec splunk bash
cd etc/apps/sreeapp
[ansible@b503b8caed0c sree_app]$ ls -l
total 16
drwxrwxrwx 8 splunk splunk 4096 Oct 29 05:00 bin
drwxrwxrwx 3 splunk splunk 4096 Oct 29 05:06 default
drwxrwxrwx 2 splunk splunk 4096 Oct 29 04:42 local
drwxrwxrwx 2 splunk splunk 4096 Oct 29 04:42 metadata
[ansible@b503b8caed0c sree_app]$ ls -l bin
total 48
-rwxrwxrwx 1 splunk splunk    63 Oct 29 04:42 README
drwxrwxrwx 2 splunk splunk  4096 Oct 29 04:59 __pycache__
drwxrwxrwx 2 splunk splunk  4096 Oct 29 04:59 deprecation-2.1.0.dist-info
-rwxrwxrwx 1 splunk splunk 12895 Oct 29 04:59 deprecation.py
drwxrwxrwx 3 splunk splunk  4096 Oct 29 04:59 packaging
drwxrwxrwx 2 splunk splunk  4096 Oct 29 04:59 packaging-24.1.dist-info
drwxrwxrwx 2 splunk splunk  4096 Oct 29 04:59 splunk_sdk-2.0.2.dist-info
drwxrwxrwx 5 splunk splunk  4096 Oct 29 04:59 splunklib
-rwxrwxrwx 1 splunk splunk   363 Oct 29 05:03 sreeapp.py
[ansible@b503b8caed0c sree_app]$ ls -l default/
total 12
-rwxrwxrwx 1 splunk splunk  180 Oct 29 04:42 app.conf
-rwxrwxrwx 1 splunk splunk   46 Oct 29 05:06 commands.conf
drwxrwxrwx 3 splunk splunk 4096 Oct 29 04:42 data


[ansible@b503b8caed0c splunk]$ cd etc/apps/sree_app/bin

[ansible@b503b8caed0c bin]$ echo aaa|python3 sreeapp.py 
RuntimeError at "/opt/splunk/etc/apps/sree_app/bin/splunklib/searchcommands/search_command.py", line 896 : Failed to parse transport header: b'aaa\n'
Traceback:
  File "/opt/splunk/etc/apps/sree_app/bin/splunklib/searchcommands/search_command.py", line 671, in _process_protocol_v2
    metadata, body = self._read_chunk(self._as_binary_stream(ifile))
  File "/opt/splunk/etc/apps/sree_app/bin/splunklib/searchcommands/search_command.py", line 896, in _read_chunk
    raise RuntimeError(f'Failed to parse transport header: {header}')

chunked 1.0,209,0
{"inspector":{"messages":[["ERROR","RuntimeError at \"/opt/splunk/etc/apps/sree_app/bin/splunklib/searchcommands/search_command.py\", line 896 : Failed to parse transport header: b'aaa\\n'"]]},"finished":true}



EXIT SPLUNK

docker-compose exec splunk sudo ./bin/splunk restart

ON WITHOUT EXITING

sudo ./bin/splunk restart


index="tutorial_data" sourcetype="access*"|sreeapp

EXTRA TESTS

docker-compose exec box bash

TRY THIS

nano /opt/splunk/etc/apps/sreeapp/default/commands.conf  
[sreeapp123]  <== THIS IS IMPORTANT
chunked=true
filename=sreeapp.py

SPLUNK
docker-compose exec splunk bash
sudo ./bin/splunk restart

index="tutorial_data" sourcetype="access*"|sreeapp123  <=== YES!!!

AGAIN

nano -w /opt/splunk/etc/apps/sreeapp/bin/sreeapp.py                                     

import sys
from splunklib.searchcommands import dispatch, StreamingCommand, Configuration
@Configuration()
class SreeApp123(StreamingCommand): <== THIS
  def stream(self, records):
    for record in records:
      record['sree_hello']='world ' + record['host'] + " 123" <== THIS
      yield record
if __name__ == "__main__":
  dispatch(SreeApp123, sys.argv, sys.stdin, sys.stdout, __name__) <== THIS
  
index="tutorial_data" sourcetype="access*"|sreeapp123 YES!! NO RESTART

index="tutorial_data" | head 1|format

index="tutorial_data" sourcetype="vendor_sales"  | head 1|format

( ( AcctID="6024298300471575" AND Code="B" AND VendorID="5036" AND date_hour="18" AND date_mday="21" AND date_minute="24" AND date_month="october" AND date_second="2" AND date_wday="thursday" AND date_year="2021" AND date_zone="local" AND host="vendor_sales" AND index="tutorial_data" AND linecount="1" AND punct="[//:::]_=_=_=" AND source="tutorialdata.zip:./vendor_sales/vendor_sales.log" AND sourcetype="vendor_sales" AND splunk_server="a46cc3c50f7c" AND timeendpos="21" AND timestartpos="1" ) )

[ansible@a46cc3c50f7c bin]$ exit
exit
ubuntu@ip-172-31-3-92:~/splunk-lab$ docker-compose exec box bash
root@79f86b9831aa:/# nano /opt/splunk/etc/apps/SreeApp/bin/sreeapp.py 

import sys
from splunklib.searchcommands import dispatch, StreamingCommand, Configuration
@Configuration()
class MyCommand(StreamingCommand):
  def stream(self, records):
    for record in records:
      record['hello']='world'
      record['VendorID']= record['VendorID']+'Sree'
      yield record
if __name__ == "__main__":
  dispatch(MyCommand, sys.argv, sys.stdin, sys.stdout, __name__)


index="tutorial_data" sourcetype="vendor_sales"  | head 1| sreeapp

VendorID = 5036Sree

SPLUNK CREATING CUSTOM COMMANDS USING PYTHON

STEPS

EXTRA TESTS

MORE