Splunk custom search command : call other splunk commands

alfreddupont012 — Mon, 25 Jan 2021 10:10:50 GMT

Hi all,

I have created a custom search command that need some preformated input. To do so, I always run my command with the same splunk commands before :

... | eval a=b+c | stats count by a | bin ... | my_custom_command(count,a,b,c)

Hence, i have created a macro to wrap all this code, so I only have to call my macro :

... | `my_macro(b,c)`

The problem is because it is a macro, it does not have the description of the searchbnf.conf for "my_custom_command".

So I would like to edit the code of "my_custom_command" to "embed" the splunk commands i always run (the stats, bin, eval connands) before running my own code. Is there a way to do so ?
If no, is there a way to create a searchbnf for a macro ?

topic Splunk custom search command : call other splunk commands in Splunk Dev

Splunk custom search command : call other splunk commands