python SDK integration with Splunk

srijondas — Mon, 10 May 2021 16:48:21 GMT

I am trying to implement EventingCommand interface, and return just one custom event at the end of processing multiple events in Splunk. I have the code written in Python and integrated. But for some reason, the code returns multiple events in Splunk.

Can someone point out what is the problem here?

import sys from splunklib.searchcommands
import dispatch, EventingCommand, Configuration

@Configuration()
class testpython(EventingCommand):

def transform(self, records):
list1 =[{'count': 1}]
return list1

if __name__ == "__main__": dispatch(testpython, sys.argv, sys.stdin, sys.stdout, __name__)

topic python SDK integration with Splunk in Splunk Dev

python SDK integration with Splunk