How do I avoid using an eval for a fixed value parameter in a custom command?

andrewtrobec — Wed, 25 Mar 2020 09:38:45 GMT

Hello,

I have a custom command, let's call it customcommand. This command takes two parameters, parameter1 and parameter2.

parameter1 should be a fixed value, fixedvalue, while parameter2 comes from a field in the search. In order to get the custom command working, I am currently using an eval before the custom command to fix the value for parameter1. It looks like this:

...
| eval parameter1 = "fixedvalue"
| customcommand parameter1 parameter2
...

Is there a way of setting parameter1 directly in the customcommand call? Something like:

| customcommand parameter1="fixedvalue" parameter2

I added supports_rawargs = true to my commands.conf, but it doesn't seem to resolve.

Can somebody point me in the right direction?

Thanks!

Andrew

Re: How do I avoid using an eval for a fixed value parameter in a custom command?

andrewtrobec — Sun, 29 Mar 2020 08:24:49 GMT

Figured it out finally, was quite obvious in the end. Anyways, here is a snippet that should help anyone who comes across the same problem. I used Intersplunk library and the difference is between a keyword and an option:

keywords, options = splunk.Intersplunk.getKeywordsAndOptions()
...
parameter1 = str(options.get("parameter1","NULL"))
parameter2 = str(result[keywords[0]])
...

Custom command can then be invoked like this:

| customcommand parameter1=fixedvalue parameter2

Hope this helps!

topic Re: How do I avoid using an eval for a fixed value parameter in a custom command? in Splunk Search

How do I avoid using an eval for a fixed value parameter in a custom command?

Re: How do I avoid using an eval for a fixed value parameter in a custom command?