topic Re: How to pass parameters in custom search command? in Splunk Dev

How to pass parameters in custom search command?

rajacybermak — Thu, 19 Apr 2018 13:25:48 GMT

I am trying out custom search command.
I have in commands.conf the below

[createrecord1]
chunked = true
filename = myjava.path
command.arg.1 = -jar
command.arg.2 = splunkcreaterecord1.jar

I would like to know how to pass argument values from search
eg if I type |createrecord1 **100**
it execute " java -jar splunkcreaterecord.jar" without the parameter

I would like the jar file to be executed as java -jar splunkcreaterecord.jar **100**

Kindly assist

Re: How to pass parameters in custom search command?

p_gurav — Fri, 20 Apr 2018 04:34:11 GMT

Can you try to pass argument in double quotes ""?

Re: How to pass parameters in custom search command?

rajacybermak — Sat, 21 Apr 2018 05:31:44 GMT

Thanks Gaurav for the reply.
Could you kindly elaborate

Re: How to pass parameters in custom search command?

woodcock — Sun, 22 Apr 2018 21:46:59 GMT

Define it like this:

 [createrecord1]
 chunked = true
 filename = myjava.path
 command.arg.1 = jar

Then use it like this:

... | createrecord1 jar "splunkcreaterecord1.jar"