Splunk Dev

How do I go about sending multi-lined string variables to Splunk?

dominiquevocat
SplunkTrust
SplunkTrust

splunk.intersplunk.outputResults output multiline strings in a field

I have multi-line results which I would like to output as a multi-lined text in a field.

Splunk is doing some cleaning in fields like stripping leading spaces and ignoring linefeed.
How would I go about sending multi-lined string variable to Splunk?

0 Karma
1 Solution

dominiquevocat
SplunkTrust
SplunkTrust

Simple enough... multivalue values are strings in a list

file = open(file_path,"r")

results = []
content = file.readlines()
result = {}
result["ldif"] = content
results.append(result)

file.close()
splunk.Intersplunk.outputResults(results)

View solution in original post

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

Simple enough... multivalue values are strings in a list

file = open(file_path,"r")

results = []
content = file.readlines()
result = {}
result["ldif"] = content
results.append(result)

file.close()
splunk.Intersplunk.outputResults(results)
0 Karma

Sukisen1981
Champion

Hmm this is really unclear, you need to provide us samples of what the data in splunk looks like and what you expect?

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

example:

data i would like to give back to splunk:

dn: cn=someuser,cn=people,ou=company,dc=domain,dc=com
changetype: add
cn: someuser
groupmembership: cn=group1,ou=groups,dc=domain,dc=com
groupmembership: cn=group2,ou=groups,dc=domain,dc=com

the way it looks in splunk:

dn: cn=someuser,cn=people,ou=company,dc=domain,dc=com changetype: add cn: someuser groupmembership: cn=group1,ou=groups,dc=domain,dc=com groupmembership: cn=group2,ou=groups,dc=domain,dc=com

so yeah, a multilined text is presented as a single line, stripped of linefeeds and extra whitespace.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...