topic Re: Custom Eval Command or Custom Search Command as Calculated Field? in Splunk Search

Custom Eval Command or Custom Search Command as Calculated Field?

snoobzilla — Mon, 03 Oct 2016 11:02:59 GMT

Is it possible to include a custom search command in your app as a calculated field? One that would automatically appear as part of Verbose search results?

From what I have seen/read it looks like a custom command has to be used as part of the stream of search commands, and is never an extension of eval which is what I think would be required to accomplish above.

Trying to decide whether to invest time in a custom search command vs just using a macro.

Thanks

Re: Custom Eval Command or Custom Search Command as Calculated Field?

rjthibod — Mon, 03 Oct 2016 14:10:07 GMT

I am confused by what you are asking. The fields that appear on the left-hand side of Verbose search results are fields extracted at search-time. Those are most often set in props.conf of an app.

So are you asking for help with a search-time calculated field or do you mean an actual custom search (SPL) command? The latter can be included in an app, but takes a few steps.

Re: Custom Eval Command or Custom Search Command as Calculated Field?

somesoni2 — Mon, 03 Oct 2016 15:00:50 GMT

You're correct about the custom search commands being not available for eval function. I would go with macro if that's possible.

Re: Custom Eval Command or Custom Search Command as Calculated Field?

snoobzilla — Mon, 17 Oct 2016 15:23:32 GMT

That answers my question. It is not ideal for my use case though.