One common problem with script output is the lack of a predictable date or date format. In this situation, the easiest thing to do is to tell Splunk not to try to parse a date at all and instead use the current date. Let's make a script that lists open network connections:
from subprocess import Popen from subprocess import PIPE from collections import defaultdict import re def add_to_key(fieldname, fields): return " " + fieldname + "+" + fields[fieldname] output = Popen("netstat -n -p tcp", stdout=PIPE, shell=True).stdout.read() counts = defaultdict(int) for l in output.splitlines(): if "ESTABLISHED" in l: pattern = r"(?P<protocol>S+)s+d+s+d+s+" pattern += r"(?P<local_addr>.*?)[^d](?P<local_port>d+)s+" ...
