Splunk Dev

Editing of search results using python and not inline with my search

sarahh
Engager

Hi, is there any way where I can rename a specific value of the search results by coding it in our own custom command python file? Please help. Thanks.

Tags (4)
0 Karma

sarahh
Engager

yes, that's what i mean.

0 Karma

Ayn
Legend

I still don't understand - do you mean that you already wrote a custom command that does some other things and now you want to add this additional functionality to it?

0 Karma

sarahh
Engager

because i wanna it to be tgt with my custom command. so that when i run my custom command, the results will be out immediately.

0 Karma

Ayn
Legend

See below - I still don't understand the requirement that this has to be done in Python. Why?

0 Karma

Ayn
Legend

Why not just do

... | replace plants with somethingelse in category_id

or

... | eval category_id=if(category_id=="plants","somethingelse",category_id)

?

Or if you want to change how the actual raw data is displayed, you could instead do

... | replace "category_id = plants" with "category_id = somethingelse" in _raw

...or the same eval technique as above but with _raw instead.

sarahh
Engager

for example, theres a data in one of the search event containing "category_id = plants" Is there anyway where i can edit/shuffle the word "plants" by coding in my custom command python file? A pity i couldn't upload the picture to have a clearer view. 😞

0 Karma

Ayn
Legend

Tell us more about what you want to achieve, preferably with log samples, and we can probably advise you where to go next. Writing your own custom command is one of many routes to take, and not the easiest one so there may be other alternatives that could work even better.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...