Splunk Dev

Replace default search command

patrickhemmer
Engager

Is it possible to replace the default search command within an app with a custom one?

 

Basically what I would like to do is create a custom application where when you are in that application, and you type in the search bar, the query goes to a custom script (a generating command) instead of the default search utility.

The only way I know is to have to prefix everything with `|mycmd ...`. But this is less than ideal for 2 reasons:

1. It would be easier on users to be able to just type their query without having to remember the generating command they have to use.

2. When using the UI to select values and "add to search"/"exclude from search"/"new search", it appends `|search ...` to the query instead of passing the filter to the generating command. This results in the generating command gathering a ton of data that's just going to be filtered out. My command is capable of handling the filtering and it would be much more performant if the filter terms were passed to it directly.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It's not possible to override the built-in SPL commands.  Even if you could, it may break the behavior of the search command late in a query (that is, other than as the generating command).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

aa70627
Communicator

-

0 Karma

patrickhemmer
Engager

Why you say that? Been using it for about 9 years now.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not possible to override the built-in SPL commands.  Even if you could, it may break the behavior of the search command late in a query (that is, other than as the generating command).

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...