topic Help on custom command (Examples needed) in Splunk Search

Help on custom command (Examples needed)

sarahh — Mon, 28 Sep 2020 13:41:24 GMT

Hi,

May I ask if there is any steps on how can you have your custom command take in the search results of "x|custom command"? So that when you "x|custom command", the search results of "x" will be able to be printed out on the results panel.
For example, your custom command is to print out "Testing123" on the results panel. However, when you typed "source_type|custom command", it will print out "Testing123" and at the same time also the results of "source_type". Is there any examples or steps that I can follow so that I know what can I change in my python file?
Thanks in advance!

Re: Help on custom command (Examples needed)

Damien_Dallimor — Mon, 08 Apr 2013 15:33:09 GMT

Care to post your custom command's python code ?

Re: Help on custom command (Examples needed)

jonuwz — Mon, 08 Apr 2013 17:05:19 GMT

Custom command : 'addcustomfield.py'

import re,sys,time, splunk.Intersplunk

def doaddfield(results, settings):

  try:
    # get list of fields, and hash of arguments
    fields, argvals = splunk.Intersplunk.getKeywordsAndOptions()
    # set test message if "message" is not defined
    message         = argvals.get("message","Testing 123")

    # for each result, add fields set to message
    for r in results:
      for f in fields:
        r[f] = message

    # return the results
    splunk.Intersplunk.outputResults(results)

  except:
    import traceback
    stack =  traceback.format_exc()
    results = splunk.Intersplunk.generateErrorResults("Error : Traceback: " + str(stack))

results, dummyresults, settings = splunk.Intersplunk.getOrganizedResults()
results = doaddfield(results, settings)

commands.conf

[addcustomfield]
retainsevents = true
streaming = true
filename = addcustomfield.py

usage :

... | addcustomfield myfield message="blah blah blah"

Re: Help on custom command (Examples needed)

sarahh — Tue, 09 Apr 2013 00:54:07 GMT

Hi,
But what i wanted was " myfield message="blah" | addcustomfield " instead of "... | addcustomfield myfield message="blah" "

Re: Help on custom command (Examples needed)

jonuwz — Tue, 09 Apr 2013 06:27:36 GMT

You asked for an example where new fields are added to the existing result set. Thats exactly what the above does.

The "..." Is a search I.e sourcetype=syslog . then you can do | addcustomfield myfield to add myfiled to the list of fields.

If you want to hard code these in the example above, change the default message, and hard code "f"