Splunk Dev

How do I go about sending multi-lined string variables to Splunk?

dominiquevocat
SplunkTrust
SplunkTrust

splunk.intersplunk.outputResults output multiline strings in a field

I have multi-line results which I would like to output as a multi-lined text in a field.

Splunk is doing some cleaning in fields like stripping leading spaces and ignoring linefeed.
How would I go about sending multi-lined string variable to Splunk?

0 Karma
1 Solution

dominiquevocat
SplunkTrust
SplunkTrust

Simple enough... multivalue values are strings in a list

file = open(file_path,"r")

results = []
content = file.readlines()
result = {}
result["ldif"] = content
results.append(result)

file.close()
splunk.Intersplunk.outputResults(results)

View solution in original post

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

Simple enough... multivalue values are strings in a list

file = open(file_path,"r")

results = []
content = file.readlines()
result = {}
result["ldif"] = content
results.append(result)

file.close()
splunk.Intersplunk.outputResults(results)
0 Karma

Sukisen1981
Champion

Hmm this is really unclear, you need to provide us samples of what the data in splunk looks like and what you expect?

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

example:

data i would like to give back to splunk:

dn: cn=someuser,cn=people,ou=company,dc=domain,dc=com
changetype: add
cn: someuser
groupmembership: cn=group1,ou=groups,dc=domain,dc=com
groupmembership: cn=group2,ou=groups,dc=domain,dc=com

the way it looks in splunk:

dn: cn=someuser,cn=people,ou=company,dc=domain,dc=com changetype: add cn: someuser groupmembership: cn=group1,ou=groups,dc=domain,dc=com groupmembership: cn=group2,ou=groups,dc=domain,dc=com

so yeah, a multilined text is presented as a single line, stripped of linefeeds and extra whitespace.

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...