Getting Data In

external script in commands.conf to create key/value pair

pkeller
Contributor

I've created a script that, when called from the search bar using:

|script foo.py | outputtext

it outputs a table containing one unnamed column containing the script output and an empty _raw column.
If the output is "key=value", is there a downstream command I can use that will actually create that field and value?

0 Karma
1 Solution

steveyz
Splunk Employee
Splunk Employee

you can probably use the extract/kv command, something along the lines of

... | kv kvdelim="=" pairdelim=" "

that is assuming that if you have multiple key-value pairs they are seperated by space.

see http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Extract for more details.

View solution in original post

0 Karma

pkeller
Contributor

The kv command didn't quite work for me, as the output isn't part of _raw ... outputtext prints the output as its own field header ... But, if I modify the script to produce two unique lines of output ...

  1. key
  2. value

Then, the splunk output creates a field named key and with the contents of the 2nd line of output as the value. That works well for my needs.

The only issue would be why Splunk is producing 2 rows containing null values. ( I can remedy that using | search value!="" )

0 Karma

steveyz
Splunk Employee
Splunk Employee

what is the actual name of the field that contains output? It can't actually be "unnamed". whatever the name is, you can copy it into _raw via eval

... | eval _raw = your_field_name
0 Karma

steveyz
Splunk Employee
Splunk Employee

you can probably use the extract/kv command, something along the lines of

... | kv kvdelim="=" pairdelim=" "

that is assuming that if you have multiple key-value pairs they are seperated by space.

see http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Extract for more details.

0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...