topic Re: StreamingCommand Inappropriately Removes Leading Spaces in Splunk Dev

StreamingCommand Inappropriately Removes Leading Spaces

malvidin — Thu, 23 Jul 2020 22:42:07 GMT

I can find a way to get results from a StreamingCommand to retain leading spaces. It doesn't matter if the field was fine before the app, it is gone afterward. Or even if the field wasn't processed by the command.

| makeresults | eval test1 = " " | eval test2 = urldecode("%20%20") | eval ok_here = if(test1==test2 AND len(test1) == 2, "true", "false") | eval value_for_command = "nothing_special" | customstreamingcommand field=value_for_command | eval still_ok_here = if(test1==test2 AND len(test1) == 2, "true", "false")

In this simple case, "still_ok_here" is false, but the same test was true before the command.

Re: StreamingCommand Inappropriately Removes Leading Spaces

malvidin — Sat, 25 Jul 2020 17:03:07 GMT

I found a solution, but the problem may not be with the SDK. The SDK reads the data passed from the search command, but Splunk strips the data when passed back to Splunk.

The workaround is to modify the SDK 'splunklib.searchcommands' CSV dialect to pass the data back with csv.QUOTE_ALL in internals.py. Although this is not recommended by Splunk, it is likely preferable to modifying other Splunk internals.

Re: StreamingCommand Inappropriately Removes Leading Spaces

malvidin — Sun, 26 Jul 2020 10:46:50 GMT

csv.QUOTE_NONNUMERIC also works, with potentially less overhead that csv.QUOTE_ALL