Dashboards & Visualizations

Splunk Custom Command Trimming Spaces in Fields

Arun_N_00007
New Member

Hi All,

I observed in Splunk Query Language that,

  • Any field’s values are getting trimmed after going through Splunk’s Custom Command’s execution.
  • Commands are developed using Splunk’s API and we are not touching those fields inside the command.
  • In configurations(commands.conf) found there is no such property values which can avoid this.

 

With Custom Command

With Custom Command.jpg

Without Custom Command

Without Custom Command.jpg

Custom Command Code,

import splunk.Intersplunk

results,unused1,unused2 = splunk.Intersplunk.getOrganizedResults()

keywords, argvals = splunk.Intersplunk.getKeywordsAndOptions()

field = argvals.get("field")

for r in results:

    try:

        r[field] = r[r[field]]

    except Exception, e:

        r[field] = None

splunk.Intersplunk.outputResults(results)

Labels (1)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!