topic Re: Custom Commands - Can Streaming Command return more than 1 row per result??? in Splunk Search

Custom Commands - Can Streaming Command return more than 1 row per result???

ppatrikfr — Wed, 30 Sep 2020 02:41:03 GMT

Hello, I'm creating a custom command on splunk (as you can see bellow), my problem is that from one row I want to create two.

Is it possible?

Just to keep you in the context, what i'm trying to change this single line:
main_app first_relation second_relation

into two:
main_app first_relation
main_app second_relation

import sys
import re
from splunklib.searchcommands import dispatch, StreamingCommand, Configuration


@Configuration(local=True)
class ExtractDicom(StreamingCommand):
    def stream(self, records):
        for record in records:
            record['from'] = None
            record['to'] = None
            if record['main_app'] is not None or record['main_app']!='':
                record['from'] = record['main_app']
                record['to'] = record['first_relation']
                record['from'] = record['main_app']
                record['to'] = record['second_relation']

            record['meh'] = {'data2', 'data3'}

            yield record


if __name__ == "__main__":
    dispatch(ExtractDicom, sys.argv, sys.stdin, sys.stdout, __name__)

Any kind of help I would appreciate 🙂

Re: Custom Commands - Can Streaming Command return more than 1 row per result???

arjunpkishore5 — Thu, 24 Oct 2019 12:32:36 GMT

In Line 13 and 14, you're creating your first row, in line 15 and 16, you are overriding the same row instead of crating a new row. That is why you see only one row. Not sure what you're trying to achieve here, here is the quick hack.

import sys
import re
import copy

from splunklib.searchcommands import dispatch, StreamingCommand, Configuration


 @Configuration(local=True)
 class ExtractDicom(StreamingCommand):
     def stream(self, records):
         for record in records:
             record['from'] = None
             record['to'] = None
             ret_records=[]
             if record['main_app'] is not None or record['main_app']!='':
                 ret_records[0] = copy.deepCopy(record)
                 ret_records[0]['from'] = record['main_app']
                 ret_records[0]['to'] = record['first_relation']
                 ret_records[1] = copy.deepCopy(record)
                 ret_records[1]['from'] = record['main_app']
                 ret_records[1]['to'] = record['second_relation']

             #Totally unsure what this row is trying to do!
             record['meh'] = {'data2', 'data3'}

             for ret_record in ret_records:
                yield ret_record


 if __name__ == "__main__":
     dispatch(ExtractDicom, sys.argv, sys.stdin, sys.stdout, __name__)

This is in no way production ready code. Like I said, I am unsure what you're trying to acheive. I'm just pointing out where you're going wrong.

You could also totally achieve this directly in SPL as below

| <your search>
| eval from=if(isnotnull(main_app), main_app, null())
| eval to=if(isnotnull(main_app), mvappend(first_relation, second_relation), null())
| mvexpand to

Re: Custom Commands - Can Streaming Command return more than 1 row per result???

arjunpkishore5 — Thu, 24 Oct 2019 14:42:48 GMT

Please mark as answer if this is what you were looking for