https://community.splunk.com/t5/Splunk-Search/From-Splunk-search-results-run-external-command-on-the-field/m-p/472035#M192287 <P>Hello, I want from Splunk search results run external command on the field and return results back to splunk, following is the query</P> <P>splunk query -&gt; index="test" sourcetype=_json | xmlkv | fields httpRequestBody | table httpRequestBody</P> <P>HttpRequestBody is json request, I want to run xsd validator which I already have on the json using external tool and return the results of the validator back to splunk, any advice on how can this be done ? </P> Thu, 13 Feb 2020 23:18:59 GMT msrama5 2020-02-13T23:18:59Z https://community.splunk.com/t5/Splunk-Search/From-Splunk-search-results-run-external-command-on-the-field/m-p/472035#M192287 <P>Hello, I want from Splunk search results run external command on the field and return results back to splunk, following is the query</P> <P>splunk query -&gt; index="test" sourcetype=_json | xmlkv | fields httpRequestBody | table httpRequestBody</P> <P>HttpRequestBody is json request, I want to run xsd validator which I already have on the json using external tool and return the results of the validator back to splunk, any advice on how can this be done ? </P> Thu, 13 Feb 2020 23:18:59 GMT https://community.splunk.com/t5/Splunk-Search/From-Splunk-search-results-run-external-command-on-the-field/m-p/472035#M192287 msrama5 2020-02-13T23:18:59Z https://community.splunk.com/t5/Splunk-Search/From-Splunk-search-results-run-external-command-on-the-field/m-p/472036#M192288 <P>See <A href="https://dev.splunk.com/enterprise/docs/developapps/customsearchcommands/">https://dev.splunk.com/enterprise/docs/developapps/customsearchcommands/</A> for how to create an external command in Splunk.<BR /> Once you've created your command, you will have to get it approved for use in Splunk Cloud. File a support ticket for that.</P> Fri, 14 Feb 2020 01:11:21 GMT https://community.splunk.com/t5/Splunk-Search/From-Splunk-search-results-run-external-command-on-the-field/m-p/472036#M192288 richgalloway 2020-02-14T01:11:21Z https://community.splunk.com/t5/Splunk-Search/From-Splunk-search-results-run-external-command-on-the-field/m-p/472037#M192289 <P>An alternative to ingesting the data twice into Splunk, might be validate the data before it is sent to Splunk.</P> Fri, 14 Feb 2020 15:04:27 GMT https://community.splunk.com/t5/Splunk-Search/From-Splunk-search-results-run-external-command-on-the-field/m-p/472037#M192289 efavreau 2020-02-14T15:04:27Z