How to develop custom search commands?

[yeasuh]

How to develop custom search commands?

[Brett]

Splunk provides detailed instructions and examples at https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/createcustomsearchcmd/

You can use the Splunklib python library to quickly create custom search commands in Splunk. At a bare minimum you can create a commands.con under /local and point to your sceleton python command residing under /bin and print to stdout to start with.

[jeffland]

Custom search commands are an advanced technique to enhance Splunk SPL. You write them in python, and they require a few conf files in addition to the .py and you should be good to go.

A good place to start would be these docs: https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/ - they also list some examples you can look at.

If you hit any roadblocks, be sure to ask a more detailed question 🙂