topic Re: Using the Splunk Python SDK, how do I get my custom generating search command to use the result of a subsearch as parameter? in Splunk Search

Using the Splunk Python SDK, how do I get my custom generating search command to use the result of a subsearch as parameter?

kierencrossland — Thu, 20 Aug 2015 06:55:14 GMT

I am in the process of writing a custom command using the Python SDK. It is a generating command.

I would like the command to be able to process the result of a subsearch as a parameter, much like the search command does, ie:

"| gencmd [search some stuff | table field_of_interest]"

It looks like the SearchCommandParser in the SDK is unable to parse the output for the subsearch. So perhaps I'd be better off using InterSplunk? Does anyone know if it is possible using that instead? Or if there is a way to still use the SDK?

Re: Using the Splunk Python SDK, how do I get my custom generating search command to use the result of a subsearch as parameter?

kierencrossland — Fri, 04 Sep 2015 06:58:16 GMT

Just in case anyone comes across this, I ended up dropping the SDK and just using the Intersplunk module which allows you to parse the script parameters manually.

For my purposes it was as simple as the code below, which does strip out some info like if the args have been linked by AND or OR, but this doesn't really affect what I was doing.

for arg in sys.argv:
        match = re.match(r'\s*(\S+?)\s*=\s*(\S+)', arg)

        if match:
                field = match.group(1)
                value = match.group(2)