Splunk Dev

How do I go about sending multi-lined string variables to Splunk?

dominiquevocat
SplunkTrust
SplunkTrust

splunk.intersplunk.outputResults output multiline strings in a field

I have multi-line results which I would like to output as a multi-lined text in a field.

Splunk is doing some cleaning in fields like stripping leading spaces and ignoring linefeed.
How would I go about sending multi-lined string variable to Splunk?

0 Karma
1 Solution

dominiquevocat
SplunkTrust
SplunkTrust

Simple enough... multivalue values are strings in a list

file = open(file_path,"r")

results = []
content = file.readlines()
result = {}
result["ldif"] = content
results.append(result)

file.close()
splunk.Intersplunk.outputResults(results)

View solution in original post

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

Simple enough... multivalue values are strings in a list

file = open(file_path,"r")

results = []
content = file.readlines()
result = {}
result["ldif"] = content
results.append(result)

file.close()
splunk.Intersplunk.outputResults(results)
0 Karma

Sukisen1981
Champion

Hmm this is really unclear, you need to provide us samples of what the data in splunk looks like and what you expect?

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

example:

data i would like to give back to splunk:

dn: cn=someuser,cn=people,ou=company,dc=domain,dc=com
changetype: add
cn: someuser
groupmembership: cn=group1,ou=groups,dc=domain,dc=com
groupmembership: cn=group2,ou=groups,dc=domain,dc=com

the way it looks in splunk:

dn: cn=someuser,cn=people,ou=company,dc=domain,dc=com changetype: add cn: someuser groupmembership: cn=group1,ou=groups,dc=domain,dc=com groupmembership: cn=group2,ou=groups,dc=domain,dc=com

so yeah, a multilined text is presented as a single line, stripped of linefeeds and extra whitespace.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...