https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21776#M233 <P>Tell us more about what you want to achieve, preferably with log samples, and we can probably advise you where to go next. Writing your own custom command is one of many routes to take, and not the easiest one so there may be other alternatives that could work even better.</P> Thu, 02 May 2013 06:43:22 GMT Ayn 2013-05-02T06:43:22Z https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21775#M232 <P>Hi, is there any way where I can rename a specific value of the search results by coding it in our own custom command python file? Please help. Thanks.</P> Thu, 02 May 2013 03:04:40 GMT https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21775#M232 sarahh 2013-05-02T03:04:40Z https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21776#M233 <P>Tell us more about what you want to achieve, preferably with log samples, and we can probably advise you where to go next. Writing your own custom command is one of many routes to take, and not the easiest one so there may be other alternatives that could work even better.</P> Thu, 02 May 2013 06:43:22 GMT https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21776#M233 Ayn 2013-05-02T06:43:22Z https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21777#M234 <P>for example, theres a data in one of the search event containing "category_id = plants" Is there anyway where i can edit/shuffle the word "plants" by coding in my custom command python file? A pity i couldn't upload the picture to have a clearer view. <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Sat, 04 May 2013 14:16:21 GMT https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21777#M234 sarahh 2013-05-04T14:16:21Z https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21778#M235 <P>Why not just do</P> <PRE><CODE>... | replace plants with somethingelse in category_id </CODE></PRE> <P>or</P> <PRE><CODE>... | eval category_id=if(category_id=="plants","somethingelse",category_id) </CODE></PRE> <P>?</P> <P>Or if you want to change how the actual raw data is displayed, you could instead do</P> <PRE><CODE>... | replace "category_id = plants" with "category_id = somethingelse" in _raw </CODE></PRE> <P>...or the same eval technique as above but with _raw instead.</P> Sat, 04 May 2013 14:22:41 GMT https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21778#M235 Ayn 2013-05-04T14:22:41Z https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21779#M236 <P>See below - I still don't understand the requirement that this has to be done in Python. Why?</P> Sat, 04 May 2013 14:26:49 GMT https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21779#M236 Ayn 2013-05-04T14:26:49Z https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21780#M237 <P>because i wanna it to be tgt with my custom command. so that when i run my custom command, the results will be out immediately.</P> Sun, 05 May 2013 11:48:57 GMT https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21780#M237 sarahh 2013-05-05T11:48:57Z https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21781#M238 <P>I still don't understand - do you mean that you already wrote a custom command that does some other things and now you want to add this additional functionality to it?</P> Mon, 06 May 2013 04:12:48 GMT https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21781#M238 Ayn 2013-05-06T04:12:48Z https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21782#M239 <P>yes, that's what i mean.</P> Mon, 06 May 2013 05:30:24 GMT https://community.splunk.com/t5/Splunk-Dev/Editing-of-search-results-using-python-and-not-inline-with-my/m-p/21782#M239 sarahh 2013-05-06T05:30:24Z