https://community.splunk.com/t5/Splunk-Dev/Is-it-possible-to-make-an-mvexpand-in-custom-python-search/m-p/184661#M2464 <P>That doesn't help at all, sorry, I was asking on how to make a mvexpand in my code... not how to retrieve Data...</P> <P>Let say, I'm reading a line, and I want to duplicate this line x-time, to expand the values from one field (what mvexpand make in the search command, but I need to make it in the script)</P> Mon, 18 Aug 2014 13:37:08 GMT sbsbb 2014-08-18T13:37:08Z https://community.splunk.com/t5/Splunk-Dev/Is-it-possible-to-make-an-mvexpand-in-custom-python-search/m-p/184659#M2462 <P>I would like to make a streamable custom function, that get some xml message :</P> <P>index=* parameter1=2 | myCustomFunction</P> <P>This function should read the content of field1, and for each element write a new line.<BR /> Is it possible to make an "mvexpand" in my custom python search function ? Can I add a result event ?</P> Sat, 16 Aug 2014 08:17:35 GMT https://community.splunk.com/t5/Splunk-Dev/Is-it-possible-to-make-an-mvexpand-in-custom-python-search/m-p/184659#M2462 sbsbb 2014-08-16T08:17:35Z https://community.splunk.com/t5/Splunk-Dev/Is-it-possible-to-make-an-mvexpand-in-custom-python-search/m-p/184660#M2463 <P>Hi sbsbb,</P> <P>yes, this is possible within your script. You need to load the following Splunk Python module <CODE>splunk.Intersplunk</CODE> and use <CODE>splunk.Intersplunk.getOrganizedResults()</CODE> to recieve key=value pairs from the previous results.</P> <P>This means, if your base search returns <CODE>field1=foo</CODE> your script can then use this key <CODE>field1</CODE> and its value of <CODE>foo</CODE>.</P> <P>As always, docs is a good place to start <A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/AdvancedDev/Searchscripts">Custom search commands</A></P> <P>hope this helps to get you started ...</P> <P>cheers, MuS</P> Mon, 18 Aug 2014 10:44:27 GMT https://community.splunk.com/t5/Splunk-Dev/Is-it-possible-to-make-an-mvexpand-in-custom-python-search/m-p/184660#M2463 MuS 2014-08-18T10:44:27Z https://community.splunk.com/t5/Splunk-Dev/Is-it-possible-to-make-an-mvexpand-in-custom-python-search/m-p/184661#M2464 <P>That doesn't help at all, sorry, I was asking on how to make a mvexpand in my code... not how to retrieve Data...</P> <P>Let say, I'm reading a line, and I want to duplicate this line x-time, to expand the values from one field (what mvexpand make in the search command, but I need to make it in the script)</P> Mon, 18 Aug 2014 13:37:08 GMT https://community.splunk.com/t5/Splunk-Dev/Is-it-possible-to-make-an-mvexpand-in-custom-python-search/m-p/184661#M2464 sbsbb 2014-08-18T13:37:08Z https://community.splunk.com/t5/Splunk-Dev/Is-it-possible-to-make-an-mvexpand-in-custom-python-search/m-p/184662#M2465 <P>okay, completely miss understood the question in this case <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Still, if you want to write a custom command that reads something from events ( like <CODE>mvexpand</CODE> does ) your custom command script needs the splunk.Intersplunk module to be loaded.</P> Mon, 18 Aug 2014 13:46:57 GMT https://community.splunk.com/t5/Splunk-Dev/Is-it-possible-to-make-an-mvexpand-in-custom-python-search/m-p/184662#M2465 MuS 2014-08-18T13:46:57Z https://community.splunk.com/t5/Splunk-Dev/Is-it-possible-to-make-an-mvexpand-in-custom-python-search/m-p/184663#M2466 <P>I know that...<BR /> In fact I was not aware that I can simply just append many row to the results (thats what mvexpand make) :<BR /> for result in results:</P> <PRE><CODE> out_results.append(result) out_results.append(result) si.outputResults(out_results) </CODE></PRE> Mon, 25 Aug 2014 14:54:27 GMT https://community.splunk.com/t5/Splunk-Dev/Is-it-possible-to-make-an-mvexpand-in-custom-python-search/m-p/184663#M2466 sbsbb 2014-08-25T14:54:27Z