Splunk Dev

Custom search command always shows Statistics tab

plucas_splunk
Splunk Employee
Splunk Employee

I have a custom search command nbclosest that returns a subset of search results used like:

index="muni" | nbclosest

That is if there were results containing log entries A, B, C, D, E, it would return a subset, say, A, B, D.

It works (in that only a subset of log entries are returned), but when I run the search, the UI always shows the Statistics tab containing every field in column format ( _raw, _time, ... date_wday, ...).

I want it to show the Events tab as usual, but only the returned subset. (The Events tab shows all the original pre-filtered log entries.)

alt text

How can I get what I want?

FYI, my commands.conf is:

[nbclosest]
filename = nbclosest.py
enableheader = false
overrides_timeorder = true
required_fields = _time,vehicle_id,vehicle_distance,stop_tag

The script is:

#! /usr/bin/env python

import csv
import operator
import sys

K_STAG      = 'stop_tag'
K_TIME      = '_time'
K_VDISTANCE = 'vehicle_distance'
K_VID       = 'vehicle_id'

vehicle_dict = { }

try:
    reader = csv.DictReader( sys.stdin )
    headers = reader.fieldnames
    writer = csv.DictWriter( sys.stdout, headers )
    writer.writeheader()

    for row in reader:
        vid = row[ K_VID ]
        if vid not in vehicle_dict:
            vehicle_dict[ vid ] = row
        else:
            old_row = vehicle_dict[ vid ]
            old_stop = old_row[ K_STAG ]
            new_stop =     row[ K_STAG ]
            if new_stop == old_stop:
                old_distance = int( old_row[ K_VDISTANCE ] )
                new_distance = int(     row[ K_VDISTANCE ] )
                if new_distance <= old_distance:
                    vehicle_dict[ vid ] = row
            else:
                writer.writerow( old_row )
                vehicle_dict[ vid ] = row

    remaining_rows = vehicle_dict.values()
    for row in sorted( remaining_rows, key=operator.itemgetter( K_TIME ) ):
        writer.writerow( row )

except Exception as e:
    import traceback
    stack = traceback.format_exc()
    print >>sys.stderr, "Unhandled exception: %s; %s" % (e, stack)
0 Karma

irsysintegratio
Path Finder

Actually it does not need v2. V1 works as well. Just need to set this in your command.conf for the command:
retainsevents=true

plucas_splunk
Splunk Employee
Splunk Employee

But new code should use v2.

0 Karma

inventsekar
Ultra Champion

Raw event searches will show the "Events" tab, by default.
Report-generating searches (stats, timechart, top, etc) will show the "Statistics" tab by default.

About the search results tabs -
When you run a search, the types of search commands you use affects which
search results tab get populated. If your search just retrieves events, you can
view the results in the Events tab, but not in the other tabs. If the search includes
transforming commands, you can view the results in the Statistics and
Visualization tabs.
http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchTutorial/Aboutthesearchtabs

on your python script, i am not seeing any splunk commands. if you give us the splunk query, maybe, we can see, if possible to add a "raw event search command" at the end and make it return the "Events" tab by default.

0 Karma

plucas_splunk
Splunk Employee
Splunk Employee

Actually, I finally figured out how to use the protocol version 2 (the documentation is pretty sketchy). My scripts using v2 works as I want. So I suppose never mind.

0 Karma

irsysintegratio
Path Finder

How can you do that please?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...