Related Answers
Download topic as PDF
script
Description
Calls an external python program that can modify or generate search results. Scripts must be declared in the commands.conf file and be located in the $SPLUNK_HOME/etc/apps/<app_name>/bin/ directory. The script is executed using $SPLUNK_HOME/bin/python.
If you are using Splunk Cloud and want to install a custom script, file a Support ticket. Before being installed, your script is checked to ensure it complies with Splunk requirements for security, data safety, and so on.
Syntax
script <script-name> [<script-arg>...] [maxinputs=<int>]
Required arguments
- script-name
- Syntax: <string>
- Description: The name of the scripted search command to run, as defined in the
commands.conffile.
Optional arguments
- maxinputs
- Syntax: maxinputs=<int>
- Description: Specifies how many of the input results are passed to the script.
- Default: 100
- script-arg
- Syntax: <string> ...
- Description: One or more arguments to pass to the script. If you are passing multiple arguments, delimit each argument with a space.
Usage
The script command is effectively an alternative way to invoke custom search commands.
See About writing custom search commands.
The following search
| script commandname
is largely synonymous with
| commandname
Note: Some functions of the script command have been removed over time. The explicit choice of Perl or Python as an argument is no longer functional and such an argument is ignored. If you need to write Perl search commands you need to declare them as Perl in the commands.conf file. This is not recommended, as you need to determine a number of underdocumented things about the input and output formats. Additionally, support for explicit filename reference for scripts in the etc/searchscripts directory has been removed. All search commands must now be declared in the commands.conf file.
Examples
Example 1:
Run the Python script "myscript" with arguments, myarg1 and myarg2; then, email the results.
... | script myscript myarg1 myarg2 | sendemail to=david@splunk.com
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the script command.
|
PREVIOUS savedsearch |
NEXT scrub |
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.10, 6.4.11, 6.5.0, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 8.0.0, 8.0.1, 6.4.9, 6.5.1, 6.5.10, 6.5.1612 (Splunk Cloud only)
Comments
The "Custom search commands" link in the Usage paragraph is broken.
It doesn't seem to matter if perl or python or neither is put on the command line - what matters is commands.conf - see http://docs.splunk.com/Documentation/Splunk/6.0.1/Admin/Commandsconf<br /><br />Also note that "commands.conf.example" is wrong. It has TYPE=... and FILENAME=... where it should have type=... and filename=...
I feel there is a bug. IF I run a saved search and put script command, the script command is executed multiple times.<br />eg.<br />| savedsearch mySavedSearch | script samplePython <br /> <br />The number times script runs varies on the duration of the savedsearch !!
This 'script' command doesn't seem to run any python/perl script living in $SPLUNK_HOME$/etc/searchscripts. In order to run a script in your search bar it must be configured in $SPLUNK_HOME$/etc/system/local/commands.conf like below.<br /><br />[sayhello]<br />FILENAME = sayhello.py<br /><br />And the name of stanza should match the name of script file as well.
#!/usr/bin/perl<br />chomp($search_in=@ARGV[0]);<br />#-- scalar context<br />$result = `/usr/local/bin/mybin $search_in`;<br />print "MYFIELD=",$result;<br /><br />I tried this script and it "works" but I can't manage output and put it on a table for example.
Richgalloway, thanks for pointing out the broken link. I have fixed it.