Developing for Splunk Enterprise

Splunk custom search command : call other splunk commands


Hi all,


I have created a custom search command that need some preformated input. To do so, I always run my command with the same splunk commands before :

| eval a=b+c
| stats count by a
| bin ...
| my_custom_command(count,a,b,c)

Hence, i have created a macro to wrap all this code, so I only have to call my macro :

... | `my_macro(b,c)`

The problem is because it is a macro, it does not have the description of the searchbnf.conf for "my_custom_command".


So I would like to edit the code of "my_custom_command" to "embed" the splunk commands i always run  (the stats, bin, eval connands) before running my own code. Is there a way to do so ?
If no, is there a way to create a searchbnf for a macro ?

Labels (2)