Search script - stdin contents

Sqig — Wed, 31 Aug 2011 20:47:06 GMT

Hi. I'm starting to work with custom search commands. For now, I need to use Perl.

Just to get started, I did a simple thing to read STDIN and dump the results to a text file on the system.

Along with the actual Results data I expected to see, I see things that start with some of this stuff (usually followed by things that are part of my actual Splunk search:
keywords: (+ elements of my search)
search:search%20 (+ my search)
sharedStorage: (location of my pooled search head shared storage)

The painful part of this is that this extra info is interspersed with the rest of my actual search results, so it's not like I can skip lines until I start seeing valid data.

I haven't found any information on exactly why this data appears in STDIN.

Can anyone shed light on this or at least point me towards some documentation that I may have missed?

Thank you.

Re: Search script - stdin contents

Sqig — Thu, 01 Sep 2011 18:46:08 GMT

I think I found the answer to this one. It looks like if I specify the following on commands.conf, I don't get the extra information:

enableheader = false

Re: Search script - stdin contents

alexl1 — Tue, 17 Apr 2012 21:08:39 GMT

how do u get stdin to go to perl?

topic Re: Search script - stdin contents in Getting Data In

Search script - stdin contents

Re: Search script - stdin contents

Re: Search script - stdin contents