Add an add-on command in splunk

[lremember]

I want to add a command to my add on, with the aim of passing the splunk spl query results to that command, and then processing it to return the data to splunk's statistical information.

there is my spl command:index="test" | stats count by asset | eval to_query=asset | fields to_query | compromiseBut the processing of requests in my command is synchronous, which consumes a lot of time

def stream(self, records):

    for record in records:

        logger.info(records)

        to_query = record.get("to_query")

        data = self.ti_compromise(to_query)

        logger.info(data)

        if data:

            res = deepcopy(record)

            if data[to_query]:

                for ioc in data[to_query]:

                    if not ioc["ioc"][2]:

                        ioc["ioc"][2] = " "

                    res.update({PREFIX + key: value for key, value in ioc.items()})

                    yield res

            else:

                res.update(EMPTY_RTN)

                yield res

 

 

The method of "self.ti_compromise(to_query)" is to request other interfaces.

 

Can I modify the above method to concurrent processing on Splunk?　If possible, which plan would be better。

Also, can the statistical information of Splunk receive list types, such as：

 

[
    {
        "alert_name": "aaaaaaaaaaaa",
        "campaign": "",
        "confidence": "",
        "current_status": "",
    },
    {
        "alert_name": "bbbbbbbbbbbb",
        "campaign": "",
        "confidence": "",
        "current_status": "",

    }

]

[thellmann]

You may find our documentation on custom search commands helpful: https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/

This topic includes some useful information on building different types of custom search commands as well as links to examples.

[richgalloway]

Synchronous processing is the norm for a streaming command.  Perhaps you want a reporting command.  See the bottom of https://docs.splunk.com/DocumentationStatic/PythonSDK/1.7.4/index.html for command types.