Is it possible to make an mvexpand in custom python search function?

[sbsbb]

I would like to make a streamable custom function, that get some xml message :

index=* parameter1=2 | myCustomFunction

This function should read the content of field1, and for each element write a new line.
Is it possible to make an "mvexpand" in my custom python search function ? Can I add a result event ?

[MuS · Accepted solution]

Hi sbsbb,

yes, this is possible within your script. You need to load the following Splunk Python module splunk.Intersplunk and use splunk.Intersplunk.getOrganizedResults() to recieve key=value pairs from the previous results.

This means, if your base search returns field1=foo your script can then use this key field1 and its value of foo.

As always, docs is a good place to start Custom search commands

hope this helps to get you started ...

cheers, MuS

[sbsbb]

I know that...
In fact I was not aware that I can simply just append many row to the results (thats what mvexpand make) :
for result in results:

        out_results.append(result)
        out_results.append(result)  

    si.outputResults(out_results)

[MuS]

okay, completely miss understood the question in this case 🙂

Still, if you want to write a custom command that reads something from events ( like mvexpand does ) your custom command script needs the splunk.Intersplunk module to be loaded.

[sbsbb]

That doesn't help at all, sorry, I was asking on how to make a mvexpand in my code... not how to retrieve Data...

Let say, I'm reading a line, and I want to duplicate this line x-time, to expand the values from one field (what mvexpand make in the search command, but I need to make it in the script)