Splunk Dev

Is there a way to run map function in a custom command reporting command map, when only reduce executes??

munang
Path Finder


I am developing a Reporting command. However, a problem was found in the search command I made. To explain the problem, I have attached some code snippets of splunk_python_sdk.

0. First, the final query I want to run is

index=splunk_example 
| table test, test_results
| customcommand(reporting command)

However, the command was not executed properly. However, the strange thing was that this command was executed using the index stored in the search header. However, the command was not executed on the index stored in the indexer.

 

1. found out
- So what I found out was that the map phase runs on the indexer and the rest of the reduce phase runs on the search header.

- And I checked the source code provided by the SDK, and I thought that the data extracted from the indexer can be passed as records when the map function is executed after checking the following related to the map function.

-> Q) Execution of the reporting command is done in two stages: map and reduce, but only  the reduce function actually executes. Is there any way to run the map function?

 

 

 

## 1-1. Here is the code provided by the sdk. 

def map(self, records):
        """ Override this method to compute partial results.
        :param records:
        :type records:
        You must override this method, if :code:`requires_preop=True`.
        """
        return NotImplemented

    def prepare(self):

        phase = self.phase

        if phase == 'map':
            # noinspection PyUnresolvedReferences
            self._configuration = self.map.ConfigurationSettings(self)
            return

        if phase == 'reduce':
            streaming_preop = chain((self.name, 'phase="map"', str(self._options)), self.fieldnames)
            self._configuration.streaming_preop = ' '.join(streaming_preop)
            return

        raise RuntimeError('Unrecognized reporting command phase: {}'.format(json_encode_string(six.text_type(phase))))

    def reduce(self, records):
        """ Override this method to produce a reporting data structure.
        You must override this method.
        """
        raise NotImplementedError('reduce(self, records)')

 

 

 

 

2. how i tried

- In this code, it is suggested to enable the requires_preop option to true to run the map function.

 

 

 

@Configuration()
    class TestReportingCommand(ReportingCommand):

@Configuration(requires_preop = True)
def map(self, records):
...

def reduce(self, records):

 

 

 

 

- commands.conf (add)

requires_preop = true

 

So, I tried both methods, but when I took a log, only the reduce function was executed and the map function was not executed.

 

If you know how to use map, please share.

I used a translator, so there may be some awkwardness in the text.

Labels (2)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...