Hi. I'm starting to work with custom search commands. For now, I need to use Perl.
Just to get started, I did a simple thing to read STDIN and dump the results to a text file on the system.
Along with the actual Results data I expected to see, I see things that start with some of this stuff (usually followed by things that are part of my actual Splunk search:
keywords: (+ elements of my search)
search:search%20 (+ my search)
sharedStorage: (location of my pooled search head shared storage)
The painful part of this is that this extra info is interspersed with the rest of my actual search results, so it's not like I can skip lines until I start seeing valid data.
I haven't found any information on exactly why this data appears in STDIN.
Can anyone shed light on this or at least point me towards some documentation that I may have missed?
Thank you.
