Archive
Highlighted

How do I go about sending multi-lined string variables to Splunk?

Motivator

splunk.intersplunk.outputResults output multiline strings in a field

I have multi-line results which I would like to output as a multi-lined text in a field.

Splunk is doing some cleaning in fields like stripping leading spaces and ignoring linefeed.
How would I go about sending multi-lined string variable to Splunk?

0 Karma
Highlighted

Re: How do I go about sending multi-lined string variables to Splunk?

Champion

Hmm this is really unclear, you need to provide us samples of what the data in splunk looks like and what you expect?

0 Karma
Highlighted

Re: How do I go about sending multi-lined string variables to Splunk?

Motivator

example:

data i would like to give back to splunk:

dn: cn=someuser,cn=people,ou=company,dc=domain,dc=com
changetype: add
cn: someuser
groupmembership: cn=group1,ou=groups,dc=domain,dc=com
groupmembership: cn=group2,ou=groups,dc=domain,dc=com

the way it looks in splunk:

dn: cn=someuser,cn=people,ou=company,dc=domain,dc=com changetype: add cn: someuser groupmembership: cn=group1,ou=groups,dc=domain,dc=com groupmembership: cn=group2,ou=groups,dc=domain,dc=com

so yeah, a multilined text is presented as a single line, stripped of linefeeds and extra whitespace.

0 Karma
Highlighted

Re: How do I go about sending multi-lined string variables to Splunk?

Motivator

Simple enough... multivalue values are strings in a list

file = open(file_path,"r")

results = []
content = file.readlines()
result = {}
result["ldif"] = content
results.append(result)

file.close()
splunk.Intersplunk.outputResults(results)

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.