I've created a script that, when called from the search bar using:
|script foo.py | outputtext
it outputs a table containing one unnamed column containing the script output and an empty _raw column.
If the output is "key=value", is there a downstream command I can use that will actually create that field and value?
The kv command didn't quite work for me, as the output isn't part of _raw ... outputtext prints the output as its own field header ... But, if I modify the script to produce two unique lines of output ...
Then, the splunk output creates a field named key and with the contents of the 2nd line of output as the value. That works well for my needs.
The only issue would be why Splunk is producing 2 rows containing null values. ( I can remedy that using | search value!="" )