Splunk Dev

Replace default search command

patrickhemmer
Engager

Is it possible to replace the default search command within an app with a custom one?

 

Basically what I would like to do is create a custom application where when you are in that application, and you type in the search bar, the query goes to a custom script (a generating command) instead of the default search utility.

The only way I know is to have to prefix everything with `|mycmd ...`. But this is less than ideal for 2 reasons:

1. It would be easier on users to be able to just type their query without having to remember the generating command they have to use.

2. When using the UI to select values and "add to search"/"exclude from search"/"new search", it appends `|search ...` to the query instead of passing the filter to the generating command. This results in the generating command gathering a ton of data that's just going to be filtered out. My command is capable of handling the filtering and it would be much more performant if the filter terms were passed to it directly.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It's not possible to override the built-in SPL commands.  Even if you could, it may break the behavior of the search command late in a query (that is, other than as the generating command).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

aa70627
Communicator

-

0 Karma

patrickhemmer
Engager

Why you say that? Been using it for about 9 years now.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not possible to override the built-in SPL commands.  Even if you could, it may break the behavior of the search command late in a query (that is, other than as the generating command).

---
If this reply helps you, Karma would be appreciated.
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26   With threats moving at machine speed and attack surfaces expanding across hybrid ...

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

The surge in machine data is already hitting enterprise budgets, and the agentic era will only intensify it. ...