Getting Data In

How to put results of custom search command into index

New Member

Hello all,
I have add-on with written a custom search command. This command call my python package.

from lazy import Lazy
from splunklib.searchcommands import (
from my_package import MyFunc

class MyCommand(StreamingCommand):
    def __init__(self):
        super(MyCommand, self).__init__()

    def prepare(self):
        settings = Settings(self.service.confs,

        self._action = Lazy(
            tr=Lazy(self.connect, settings),

    def stream(self, records):
        index = self.service.indexes['my_index']  # get index
        # how to put a 'records' into 'my_index'?
        for record in records:
            yield record

    def action(self):
        ... # use my_package

    def connect(self, settings):
  1. How can I push the results of a custom search command into 'my_index', and how I can associate an index with a sourcetype?

Thank you!

0 Karma


you can index the results of your search using the collect command. Just add the collect statement at the end

<your search including your custom command>
| collect index=your_index sourcetype=your_sourcetype

Here's the documentation to the collect command -

Hope this helps.


0 Karma

New Member

Arjun thank you for an answer. I heard about 'collect', but i need push my raw JSON into index in ''.

0 Karma


Any Specific reason for not using collect ?

If you must send data directly from the script, you can use Splunk's HEC(HTTP Event Collector). With this, you would be sending data to your index through a HTTP POST request. HEC works well with JSON data

0 Karma