topic Re: Add Custom Search Command to Search Help in Splunk Search

Add Custom Search Command to Search Help

Wiggy — Mon, 28 Sep 2020 10:08:33 GMT

How can someone add a custom search command to the list that search help pops up?

I have already added a new custom search command as shown below:

In $Splunk_home/etc/system/bin I have the following script:

CustomCommand.py

In $Splunk_home/etc/system/local/commands.conf I have the following stanza:

[CustomCommand]
filename = CustomCommand.py

In $Splunk_home/etc/system/local/authorize.conf I have the following:

[[capability::run_script_CustomCommand]

[role_admin]
run_script_CustomCommand = enabled

Re: Add Custom Search Command to Search Help

Wiggy — Tue, 22 Nov 2011 22:33:18 GMT

You must add the following stanza in $Splunk_home/etc/system/local/searchbnf.conf

[CustomCommand-command]
syntax = CustomCommand <field>
description = This is a description of my CustomCommand
usage = public

Once this is added and splunk is restarted, the command should pop up in the search help when you are typing in your relevant search.

Re: Add Custom Search Command to Search Help

dwaddle — Sat, 03 Dec 2011 22:02:06 GMT

Also -- if you want to share your custom command across apps and have the help still work, you'll need to update the app's default.meta or local.meta to add an entry for searchbnf as follows:

[searchbnf]
export = system

Re: Add Custom Search Command to Search Help

rsathish47 — Thu, 05 Jun 2014 12:47:30 GMT

Thank you dwaddle it helped me

Re: Add Custom Search Command to Search Help

i2sheri — Tue, 22 Dec 2015 06:11:03 GMT

Thanks a lot 🙂