topic Re: How to search custom fields from Splunk SDK? in Splunk Dev

How to search custom fields from Splunk SDK?

scottmacdonald — Tue, 12 Dec 2017 15:12:59 GMT

I can't find documentation anywhere on how to format search strings for the Splunk SDK. Every single example provided just uses:

search index=_internal | head 10

I'm just trying to search on a custom field I use in my application, so I thought this would work:

search index=myindex mycustomfield=xyz

but that just gives me an error: Bad Request: FATAL: Unknown search command mycustomfield

How do I format this as I want? And perhaps more importantly where is this documented how the SDK expects requests to be formatted?

Re: How to search custom fields from Splunk SDK?

damien_chillet — Tue, 12 Dec 2017 15:56:48 GMT

Hi scott,

Can you provide us with a sample of the code you're using to get this error?

Re: How to search custom fields from Splunk SDK?

micahkemp — Tue, 12 Dec 2017 16:59:08 GMT

See if this answer from yesterday helps.

Re: How to search custom fields from Splunk SDK?

scottmacdonald — Tue, 12 Dec 2017 17:26:15 GMT

@micahkemp that actually did help but not for the reason you would think...turns out it was a dumb mistake on my part, I had two variables declared named search and searchStr and i mixed the two up and was passing in the wrong one without the 'search' part at the beginning. Stupid mistake but thanks for the tip