Archive

From Splunk search results run external command on the field

Explorer

Hello, I want from Splunk search results run external command on the field and return results back to splunk, following is the query

splunk query -> index="test" sourcetype=_json | xmlkv | fields httpRequestBody | table httpRequestBody

HttpRequestBody is json request, I want to run xsd validator which I already have on the json using external tool and return the results of the validator back to splunk, any advice on how can this be done ?

0 Karma

Builder

An alternative to ingesting the data twice into Splunk, might be validate the data before it is sent to Splunk.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

SplunkTrust
SplunkTrust

See https://dev.splunk.com/enterprise/docs/developapps/customsearchcommands/ for how to create an external command in Splunk.
Once you've created your command, you will have to get it approved for use in Splunk Cloud. File a support ticket for that.

---
If this reply helps you, an upvote would be appreciated.
0 Karma