Developing for Splunk Enterprise

Replace default search command

patrickhemmer
Engager

Is it possible to replace the default search command within an app with a custom one?

 

Basically what I would like to do is create a custom application where when you are in that application, and you type in the search bar, the query goes to a custom script (a generating command) instead of the default search utility.

The only way I know is to have to prefix everything with `|mycmd ...`. But this is less than ideal for 2 reasons:

1. It would be easier on users to be able to just type their query without having to remember the generating command they have to use.

2. When using the UI to select values and "add to search"/"exclude from search"/"new search", it appends `|search ...` to the query instead of passing the filter to the generating command. This results in the generating command gathering a ton of data that's just going to be filtered out. My command is capable of handling the filtering and it would be much more performant if the filter terms were passed to it directly.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It's not possible to override the built-in SPL commands.  Even if you could, it may break the behavior of the search command late in a query (that is, other than as the generating command).

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

aa70627
Path Finder

-

0 Karma

patrickhemmer
Engager

Why you say that? Been using it for about 9 years now.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not possible to override the built-in SPL commands.  Even if you could, it may break the behavior of the search command late in a query (that is, other than as the generating command).

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!