topic Re: Trying out on custom command search in Splunk Search

Trying out on custom command search

sarahh — Mon, 01 Apr 2013 09:41:43 GMT

Hello,

I've entered "print 'Hello World'" in helloworld.py file for custom command. I also added authorize.conf & commands.conf into $SPLUNK_HOME\etc\system\local\ directory with the stanzas needed and thereafter restarted Splunk. However, when I typed "|helloworld" into the search bar, "Hello World" didnt get printed out onto the screen. What should i do?

Thanks in advance. 🙂

Re: Trying out on custom command search

jonuwz — Tue, 02 Apr 2013 14:01:13 GMT

Take a look in etc/apps/search/bin/gentimes.py for an example of a "generating" custom command.

Just putting "print 'Hello World'" into the file is not going to work.

You need to generate a "results" array containing the field/values for each of the columns, then pass it back.

helloworld.py

import re,sys,time, splunk.Intersplunk

def hello(results, settings):
    results = []
    result = {}
    result['string'] = "Hello World"
    results.append(result)
    return results

results, dummyresults, settings = splunk.Intersplunk.getOrganizedResults()
results = hello(results, settings)
splunk.Intersplunk.outputResults(results)

commands.conf

[helloworld]
filename = helloworld.py
generating = true
supports_rawargs = true

Re: Trying out on custom command search

sarahh — Thu, 04 Apr 2013 01:20:54 GMT

Oh... why is there "result" and "results"?

Re: Trying out on custom command search

jonuwz — Thu, 04 Apr 2013 07:05:22 GMT

Result is a row, results is all the rows.

Re: Trying out on custom command search

sarahh — Thu, 04 Apr 2013 07:33:33 GMT

i see. thanks!! great help. 🙂