SplunkPySearch Deprecated

Deprecated. No available replacement. Run a query through Splunk and format the results as a table.

python · Splunk

Source

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401

query = demisto.args()['query']
rows = demisto.args()['rows']

headers = ""
query = query + ' | head ' + rows
res = demisto.executeCommand('splunk-search', {'using-brand': 'splunkpy', 'query': query})
contents = res[0]['Contents']

if isError(res[0]):
    return_error("Error occured. " + str(contents))

if (res and len(res) > 0 and contents):
    if not isinstance(contents[0], dict):
        headers = "results"
    demisto.results({"Type": 1, "Contents": contents, "ContentsFormat": "json", "EntryContext": {},
                     "HumanReadable": tableToMarkdown("Splunk Search results for: " + query, contents, headers)})
else:
    demisto.results('No results.')

README

Deprecated. No available replacement. Run a query through Splunk and format the results as a table.

Script Data


Name Description
Script Type python2
Tags enhancement, splunk
Cortex XSOAR Version 6.5.0

Dependencies


This script uses the following commands and scripts.

  • splunk-search

Inputs


Argument Name Description
query Splunk query to execute
rows Return up to X first rows. If omitted, defaults to 10.

Outputs


There are no outputs for this script.