Splunk Custom Command Trimming Spaces in Fields

[Arun_N_00007]

Hi All,

I observed in Splunk Query Language that,

• Any field’s values are getting trimmed after going through Splunk’s Custom Command’s execution.
• Commands are developed using Splunk’s API and we are not touching those fields inside the command.
• In configurations(commands.conf) found there is no such property values which can avoid this.

With Custom Command

Without Custom Command

Custom Command Code,

import splunk.Intersplunk

results,unused1,unused2 = splunk.Intersplunk.getOrganizedResults()

keywords, argvals = splunk.Intersplunk.getKeywordsAndOptions()

field = argvals.get("field")

for r in results:

    try:

        r[field] = r[r[field]]

    except Exception, e:

        r[field] = None

splunk.Intersplunk.outputResults(results)