Splunk Search

From Splunk search results run external command on the field

msrama5
Explorer

Hello, I want from Splunk search results run external command on the field and return results back to splunk, following is the query

splunk query -> index="test" sourcetype=_json | xmlkv | fields httpRequestBody | table httpRequestBody

HttpRequestBody is json request, I want to run xsd validator which I already have on the json using external tool and return the results of the validator back to splunk, any advice on how can this be done ?

0 Karma

efavreau
Motivator

An alternative to ingesting the data twice into Splunk, might be validate the data before it is sent to Splunk.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

See https://dev.splunk.com/enterprise/docs/developapps/customsearchcommands/ for how to create an external command in Splunk.
Once you've created your command, you will have to get it approved for use in Splunk Cloud. File a support ticket for that.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...