Preserving multi-value fields through custom search command

dbryan — Mon, 09 Jul 2012 06:48:14 GMT

Hello,

I'm trying to build a Python custom search command. The command is run after a transaction, and adds values corresponding to events in the transaction based on the business logic.

This is my search:

sourcetype=mysourcetype | transaction User_ID keepevicted=true mvlist=true | where eventcount > 2 | positioning |  table *

This is the script for my positioning command:

#!/usr/bin/env python2.7
import splunk.Intersplunk

def handle_lines(enumerable):
    for i, line in enumerate(enumerable):
            # business logic goes here
            yield new_line

output = []
for line in handle_lines(search_results):
        output.append(line)
splunk.Intersplunk.outputResults(output)

(there's a reason for my seemingly redundant use of the generator pattern here)

Even if handle_lines yields each line without doing anything to it, Splunk seems to lose its awareness of all the multi-value fields. Instead of this:

I get this:

It does work if I change my handle_lines() function to output them as an array:

def handle_lines(enumerable):
    for i, line in enumerate(enumerable):
        new_line = {}
        for attr in line:
            new_line[attr] = line[attr].split(' ')
        # business logic goes here
        yield new_line

The problem here is that some of my fields have spaces, and this causes them to get broken into multi-valued fields as well. This wreaks havoc with what I'm trying to to back in Splunk - I'm assuming that each event has multiple values for each field corresponding to its eventcount.

I'm surprised that I'm having this issue since I'm just using the data exactly as it's provided by splunk.Intersplunk; I assumed the library would handle the multi-value field logic.

Re: Preserving multi-value fields through custom search command

dbryan — Mon, 09 Jul 2012 08:08:36 GMT

I've considered that I might need a search-time transform to replace spaces within my fields with some other values prior to passing them to my custom command, but I'd really like to avoid this if possible.

Re: Preserving multi-value fields through custom search command

dbryan — Tue, 10 Jul 2012 03:02:09 GMT

Hello, I am the supreme reigning idiot.

I was missing this in commands.conf for the custom search command:

supports_multivalues = true

topic Preserving multi-value fields through custom search command in Splunk Search

Preserving multi-value fields through custom search command

Re: Preserving multi-value fields through custom search command

Re: Preserving multi-value fields through custom search command