Hi All,
I observed in Splunk Query Language that,
- Any field’s values are getting trimmed after going through Splunk’s Custom Command’s execution.
- Commands are developed using Splunk’s API and we are not touching those fields inside the command.
- In configurations(commands.conf) found there is no such property values which can avoid this.
With Custom Command
Without Custom Command
Custom Command Code,
import splunk.Intersplunk
results,unused1,unused2 = splunk.Intersplunk.getOrganizedResults()
keywords, argvals = splunk.Intersplunk.getKeywordsAndOptions()
field = argvals.get("field")
for r in results:
try:
r[field] = r[r[field]]
except Exception, e:
r[field] = None
splunk.Intersplunk.outputResults(results)
