Archive
Highlighted

Custom Commands - Can Streaming Command return more than 1 row per result???

Path Finder

Hello, I'm creating a custom command on splunk (as you can see bellow), my problem is that from one row I want to create two.

Is it possible?

Just to keep you in the context, what i'm trying to change this single line:
mainapp firstrelation second_relation

into two:
mainapp firstrelation
mainapp secondrelation

import sys
import re
from splunklib.searchcommands import dispatch, StreamingCommand, Configuration


@Configuration(local=True)
class ExtractDicom(StreamingCommand):
    def stream(self, records):
        for record in records:
            record['from'] = None
            record['to'] = None
            if record['main_app'] is not None or record['main_app']!='':
                record['from'] = record['main_app']
                record['to'] = record['first_relation']
                record['from'] = record['main_app']
                record['to'] = record['second_relation']

            record['meh'] = {'data2', 'data3'}

            yield record


if __name__ == "__main__":
    dispatch(ExtractDicom, sys.argv, sys.stdin, sys.stdout, __name__)

Any kind of help I would appreciate 🙂

0 Karma
Highlighted

Re: Custom Commands - Can Streaming Command return more than 1 row per result???

In Line 13 and 14, you're creating your first row, in line 15 and 16, you are overriding the same row instead of crating a new row. That is why you see only one row. Not sure what you're trying to achieve here, here is the quick hack.

import sys
import re
import copy

from splunklib.searchcommands import dispatch, StreamingCommand, Configuration


 @Configuration(local=True)
 class ExtractDicom(StreamingCommand):
     def stream(self, records):
         for record in records:
             record['from'] = None
             record['to'] = None
             ret_records=[]
             if record['main_app'] is not None or record['main_app']!='':
                 ret_records[0] = copy.deepCopy(record)
                 ret_records[0]['from'] = record['main_app']
                 ret_records[0]['to'] = record['first_relation']
                 ret_records[1] = copy.deepCopy(record)
                 ret_records[1]['from'] = record['main_app']
                 ret_records[1]['to'] = record['second_relation']

             #Totally unsure what this row is trying to do!
             record['meh'] = {'data2', 'data3'}

             for ret_record in ret_records:
                yield ret_record


 if __name__ == "__main__":
     dispatch(ExtractDicom, sys.argv, sys.stdin, sys.stdout, __name__)

This is in no way production ready code. Like I said, I am unsure what you're trying to acheive. I'm just pointing out where you're going wrong.

You could also totally achieve this directly in SPL as below

| <your search>
| eval from=if(isnotnull(main_app), main_app, null())
| eval to=if(isnotnull(main_app), mvappend(first_relation, second_relation), null())
| mvexpand to
0 Karma
Highlighted

Re: Custom Commands - Can Streaming Command return more than 1 row per result???

Please mark as answer if this is what you were looking for

0 Karma