topic New field/attribute added to raw results by python in Splunk Search

New field/attribute added to raw results by python

MatthewTowey — Fri, 04 May 2012 10:20:50 GMT

I am trying to add a new field to my search results via a custom search command written in python

Take the following snippet from the script:

results,results1,results2 = splunk.Intersplunk.getOrganizedResults()

for line in results:

line["Test"] = 'Some Test Text'

When I run a search which uses this custom search command I don't see the Test field appearing in the events list, events table or results table. Just wondering if my expectation is incorrect in terms of Splunk being able to do this

Thanks
Matt

Re: New field/attribute added to raw results by python

ziegfried — Fri, 04 May 2012 10:26:35 GMT

You have to output the results after the loop (ie. once you've modified them).

splunk.Intersplunk.outputResults(results)

Re: New field/attribute added to raw results by python

MatthewTowey — Fri, 04 May 2012 11:20:28 GMT

Hi ziegfried
Thanks for the reply
Sorry I hadn't included more of the code to make it more clear.
I have the " splunk.Intersplunk.outputResults(results)"
line of code after the loop finishes.

Re: New field/attribute added to raw results by python

ziegfried — Fri, 04 May 2012 11:39:37 GMT

I see. The field should be available in the results then. What's the exact search, you're using? Is the field selected (ie. does it appear in the field picker - on the left)?

Re: New field/attribute added to raw results by python

MatthewTowey — Fri, 04 May 2012 13:25:16 GMT

Hi
I am using the following search: source="file-name.txt" | | head 2. The field does not appear in the field picker

Thanks
Matt