topic Re: custom command : how to append dynamically columns in Splunk Dev

custom command : how to append dynamically columns

sbsbb — Sun, 22 Dec 2013 02:52:41 GMT

I try to write a python command that generates results.
My problem is, that I have "n" columns, and the name of them is might be different from line to line. I can't make it with the normal results.append/outputresult

    results.append({'_time' : time, '_raw' : output})   
    si.outputResults(results)

How could I do that, it there a way to append line by line, with the columns defined in variables ?

append["line1"]
    appendcol["_time"]=time
    appendcol[r]=rr
    appendcol[s]=ss
append["line2"]
    appendcol["_time"]=time
    appendcol[x]=xx
    appendcol[y]=yy

Re: custom command : how to append dynamically columns

gkanapathy — Sun, 22 Dec 2013 04:07:59 GMT

Of course can you use append and outputresults, and I'm assuming you're using InterSplunk libraries. results is simply a python list of dicts. You can append and add whatever you want to such a list:

results.append({'_time': time, '_raw': output, 'r' : rr, 's': ss})
results.append({'_time': time, '_raw': output, 'x' : xx, 'y': yy})

and there are many other ways to work with lists and dictss:

http://docs.python.org/2.7/library/stdtypes.html#sequence-types-str-unicode-list-tuple-bytearray-buffer-xrange
http://docs.python.org/2.7/library/stdtypes.html#mapping-types-dict

Re: custom command : how to append dynamically columns

sbsbb — Sun, 22 Dec 2013 09:43:09 GMT

Thank you, but in taht case I assume the column name is fix to 'r' and 'x'. I would like to read it from a variable.

If you have a small example it would help, I'm not familiar to programming, to I don't know what I need to search for it the docs...

Many thanks

Re: custom command : how to append dynamically columns

gkanapathy — Sun, 22 Dec 2013 09:48:31 GMT

Well, then you would use r instead of 'r'. There are many excellent online tutorials of Python that can explain how the basic constructs and syntax work.

Re: custom command : how to append dynamically columns

sbsbb — Mon, 28 Sep 2020 15:32:23 GMT

I was able to make it work :
result={'_time': ttime} # getting the time field in the result row
result[ host]=str(m.getElementsByTagName('metricValue')[0].firstChild.data) #append new column in result row
results.append(result) # append result_row in results array
si.outputResults(results) # output all results