Add an add-on command in splunk

lremember — Tue, 21 Nov 2023 21:08:07 GMT

I want to add a command to my add on, with the aim of passing the splunk spl query results to that command, and then processing it to return the data to splunk's statistical information.

there is my spl command:index="test" | stats count by asset | eval to_query=asset | fields to_query | compromiseBut the processing of requests in my command is synchronous, which consumes a lot of time

def stream(self, records):

for record in records:

logger.info(records)

to_query = record.get("to_query")

data = self.ti_compromise(to_query)

logger.info(data)

if data:

res = deepcopy(record)

if data[to_query]:

for ioc in data[to_query]:

if not ioc["ioc"][2]:

ioc["ioc"][2] = " "

res.update({PREFIX + key: value for key, value in ioc.items()})

yield res

else:

res.update(EMPTY_RTN)

yield res

The method of "self.ti_compromise(to_query)" is to request other interfaces.

Can I modify the above method to concurrent processing on Splunk?　If possible, which plan would be better。

Also, can the statistical information of Splunk receive list types, such as：

[
    {
        "alert_name": "aaaaaaaaaaaa",
        "campaign": "",
        "confidence": "",
        "current_status": "",
    },
    {
        "alert_name": "bbbbbbbbbbbb",
        "campaign": "",
        "confidence": "",
        "current_status": "",

    }

]

Re: Add an add-on command in splunk

richgalloway — Tue, 21 Nov 2023 21:19:41 GMT

Synchronous processing is the norm for a streaming command. Perhaps you want a reporting command. See the bottom of https://docs.splunk.com/DocumentationStatic/PythonSDK/1.7.4/index.html for command types.

Re: Add an add-on command in splunk

thellmann — Mon, 04 Dec 2023 16:47:21 GMT

You may find our documentation on custom search commands helpful: https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/

This topic includes some useful information on building different types of custom search commands as well as links to examples.

topic Re: Add an add-on command in splunk in Splunk Dev

Add an add-on command in splunk

Re: Add an add-on command in splunk

Re: Add an add-on command in splunk