Dashboards & Visualizations

Splunk Custom Command Trimming Spaces in Fields

Arun_N_00007
New Member

Hi All,

I observed in Splunk Query Language that,

  • Any field’s values are getting trimmed after going through Splunk’s Custom Command’s execution.
  • Commands are developed using Splunk’s API and we are not touching those fields inside the command.
  • In configurations(commands.conf) found there is no such property values which can avoid this.

 

With Custom Command

With Custom Command.jpg

Without Custom Command

Without Custom Command.jpg

Custom Command Code,

import splunk.Intersplunk

results,unused1,unused2 = splunk.Intersplunk.getOrganizedResults()

keywords, argvals = splunk.Intersplunk.getKeywordsAndOptions()

field = argvals.get("field")

for r in results:

    try:

        r[field] = r[r[field]]

    except Exception, e:

        r[field] = None

splunk.Intersplunk.outputResults(results)

Labels (1)
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>