Developing for Splunk Enterprise

custom command : how to append dynamically columns

sbsbb
Builder

I try to write a python command that generates results.
My problem is, that I have "n" columns, and the name of them is might be different from line to line. I can't make it with the normal results.append/outputresult

    results.append({'_time' : time, '_raw' : output})   
    si.outputResults(results)

How could I do that, it there a way to append line by line, with the columns defined in variables ?

append["line1"]
    appendcol["_time"]=time
    appendcol[r]=rr
    appendcol[s]=ss
append["line2"]
    appendcol["_time"]=time
    appendcol[x]=xx
    appendcol[y]=yy
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Of course can you use append and outputresults, and I'm assuming you're using InterSplunk libraries. results is simply a python list of dicts. You can append and add whatever you want to such a list:

results.append({'_time': time, '_raw': output, 'r' : rr, 's': ss})
results.append({'_time': time, '_raw': output, 'x' : xx, 'y': yy})

and there are many other ways to work with lists and dictss:

http://docs.python.org/2.7/library/stdtypes.html#sequence-types-str-unicode-list-tuple-bytearray-buf...
http://docs.python.org/2.7/library/stdtypes.html#mapping-types-dict

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Of course can you use append and outputresults, and I'm assuming you're using InterSplunk libraries. results is simply a python list of dicts. You can append and add whatever you want to such a list:

results.append({'_time': time, '_raw': output, 'r' : rr, 's': ss})
results.append({'_time': time, '_raw': output, 'x' : xx, 'y': yy})

and there are many other ways to work with lists and dictss:

http://docs.python.org/2.7/library/stdtypes.html#sequence-types-str-unicode-list-tuple-bytearray-buf...
http://docs.python.org/2.7/library/stdtypes.html#mapping-types-dict

View solution in original post

0 Karma

sbsbb
Builder

I was able to make it work :
result={'_time': ttime} # getting the time field in the result row
result[ host]=str(m.getElementsByTagName('metricValue')[0].firstChild.data) #append new column in result row
results.append(result) # append result_row in results array
si.outputResults(results) # output all results

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Well, then you would use r instead of 'r'. There are many excellent online tutorials of Python that can explain how the basic constructs and syntax work.

0 Karma

sbsbb
Builder

Thank you, but in taht case I assume the column name is fix to 'r' and 'x'. I would like to read it from a variable.

If you have a small example it would help, I'm not familiar to programming, to I don't know what I need to search for it the docs...

Many thanks

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.