Splunk Dev

Replace default search command

patrickhemmer
Engager

Is it possible to replace the default search command within an app with a custom one?

 

Basically what I would like to do is create a custom application where when you are in that application, and you type in the search bar, the query goes to a custom script (a generating command) instead of the default search utility.

The only way I know is to have to prefix everything with `|mycmd ...`. But this is less than ideal for 2 reasons:

1. It would be easier on users to be able to just type their query without having to remember the generating command they have to use.

2. When using the UI to select values and "add to search"/"exclude from search"/"new search", it appends `|search ...` to the query instead of passing the filter to the generating command. This results in the generating command gathering a ton of data that's just going to be filtered out. My command is capable of handling the filtering and it would be much more performant if the filter terms were passed to it directly.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It's not possible to override the built-in SPL commands.  Even if you could, it may break the behavior of the search command late in a query (that is, other than as the generating command).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

aa70627
Communicator

-

0 Karma

patrickhemmer
Engager

Why you say that? Been using it for about 9 years now.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not possible to override the built-in SPL commands.  Even if you could, it may break the behavior of the search command late in a query (that is, other than as the generating command).

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...