https://community.splunk.com/t5/Getting-Data-In/Calling-3rd-party-script-at-index-or-search-time/m-p/71895#M14658 <P>Index-time, no. Luckily, as it would have horrible performane implications <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> <P>Search-time, certainly. Set up a script that serves as a dynamic lookup. More information in the docs here: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_fields_lookup_based_on_an_external_command_or_script">http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_fields_lookup_based_on_an_external_command_or_script</A></P> Mon, 11 Jun 2012 13:00:22 GMT Ayn 2012-06-11T13:00:22Z https://community.splunk.com/t5/Getting-Data-In/Calling-3rd-party-script-at-index-or-search-time/m-p/71894#M14657 <P>Hi,</P> <P>We use a 3rd party python library (ua_parser) that does a great job of parsing the myriad useragents that hit our site.</P> <P>Is it possible to call such a library at either index or search time?</P> <P>Obviously performance might be an issue, but I wanted to at least see if it was possible.</P> <P>thanks.</P> <P>Jon.</P> Mon, 11 Jun 2012 12:57:20 GMT https://community.splunk.com/t5/Getting-Data-In/Calling-3rd-party-script-at-index-or-search-time/m-p/71894#M14657 jcbrendsel 2012-06-11T12:57:20Z https://community.splunk.com/t5/Getting-Data-In/Calling-3rd-party-script-at-index-or-search-time/m-p/71895#M14658 <P>Index-time, no. Luckily, as it would have horrible performane implications <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> <P>Search-time, certainly. Set up a script that serves as a dynamic lookup. More information in the docs here: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_fields_lookup_based_on_an_external_command_or_script">http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_fields_lookup_based_on_an_external_command_or_script</A></P> Mon, 11 Jun 2012 13:00:22 GMT https://community.splunk.com/t5/Getting-Data-In/Calling-3rd-party-script-at-index-or-search-time/m-p/71895#M14658 Ayn 2012-06-11T13:00:22Z