topic Error occured during do run "Custom search command example" in Splunk Search

Error occured during do run "Custom search command example"

jkjeong — Thu, 18 May 2017 07:23:25 GMT

I do exercise example about "Custom search command" step by step ,

but the following error occurred. What's the problem?

bin/splunk search "linecount>1 | shape | top shape"
FATAL: Error in 'shape' command: You must provide a field argument****

example line:

http://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Customsearchcommandshape

and this example is Version 1 using the intersplunk.py SDL, is there the "Version 2" example ?

Re: Error occured during do run "Custom search command example"

irsysintegratio — Fri, 08 Sep 2017 19:51:46 GMT

Replace the first "shape" with "script shape". ,

Re: Error occured during do run "Custom search command example"

whrg — Thu, 07 Jan 2021 07:52:22 GMT

I encountered the very same error. I was following this guide: https://www.splunk.com/en_us/blog/tips-and-tricks/write-your-own-search-language.html

What I noticed was that this guide is from 2008. Newer version of Splunk already have a built-in "shape" command. This one is defined in etc/system/default/searchbnf.conf:

[shape-command] syntax = shape <field> (maxvalues=<int>)? (maxresolution=<int>)? shortdesc = Produces a symbolic 'shape' attribute describing the shape of a numeric multivalued field.

Apparently, the built-in shape command takes precedence over your custom shape command when running a search.

So I suggest rename your "shape" command to "shape2" or something else.