Have been trying to create custom command, but it seems that getOrganizedResults() doesn't
doesn't seem to get the previous search results.
Just to test things i wrote this:
import sys,splunk.Intersplunk # this call populates the results variable with all the events passed into the search script: results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults() # hand the results right back to Splunk splunk.Intersplunk.outputResults(results)
The data hadn't came back, the massage was: "No results found. Try expanding the time range."
The command was added in commands.conf, I was authorized to use it. Why can't getOrganizedResults get data?
Something like this
| inputlookup wrapper_tst.csv
| splitanalyticswrap
Data in csv liiks like this:
metric tag_split values
| revenue | tag | 0 |