Calls an external python program that can modify or generate search results.
- Splunk Cloud Platform
- You must create a private app that contains your custom script. If you are a Splunk Cloud administrator with experience creating private apps, see Manage private apps in your Splunk Cloud deployment in the Splunk Cloud Admin Manual. If you have not created private apps, contact your Splunk account representative for help with this customization.
- Splunk Enterprise
- Scripts must be declared in the
commands.conffile and be located in the
$SPLUNK_HOME/etc/apps/<app_name>/bin/directory. The script is executed using
script <script-name> [<script-arg>...] [maxinputs=<int>]
- Syntax: <string>
- Description: The name of the scripted search command to run, as defined in the
- Syntax: maxinputs=<int>
- Description: Specifies how many of the input results are passed to the script.
- Default: 100
- Syntax: <string> ...
- Description: One or more arguments to pass to the script. If you are passing multiple arguments, delimit each argument with a space.
script command is effectively an alternative way to invoke custom search commands.
See Create custom search commands for apps in Splunk Cloud or Splunk Enterprise in the Developer Guide on the Developer Portal.
The following search
| script commandname
is largely synonymous with
Some functions of the script command have been removed over time. The explicit choice of Perl or Python as an argument is no longer functional and such an argument is ignored. If you need to write Perl search commands you need to declare them as Perl in the
commands.conf file. This is not recommended, as you need to determine a number of underdocumented things about the input and output formats. Additionally, support for explicit filename reference for scripts in the
etc/searchscripts directory has been removed. All search commands must now be declared in the
Run the Python script "myscript" with arguments, myarg1 and myarg2; then, email the results.
... | script myscript myarg1 myarg2 | sendemail firstname.lastname@example.org
This documentation applies to the following versions of Splunk Cloud™: 7.0.13, 8.0.2006, 8.1.2009, 8.1.2011, 8.0.2007, 8.1.2012 (latest FedRAMP release), 8.1.2101, 8.1.2103, 8.2.2104, 8.2.2105, 8.2.2106