Splunk Dev

Replace default search command

patrickhemmer
Engager

Is it possible to replace the default search command within an app with a custom one?

 

Basically what I would like to do is create a custom application where when you are in that application, and you type in the search bar, the query goes to a custom script (a generating command) instead of the default search utility.

The only way I know is to have to prefix everything with `|mycmd ...`. But this is less than ideal for 2 reasons:

1. It would be easier on users to be able to just type their query without having to remember the generating command they have to use.

2. When using the UI to select values and "add to search"/"exclude from search"/"new search", it appends `|search ...` to the query instead of passing the filter to the generating command. This results in the generating command gathering a ton of data that's just going to be filtered out. My command is capable of handling the filtering and it would be much more performant if the filter terms were passed to it directly.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

It's not possible to override the built-in SPL commands.  Even if you could, it may break the behavior of the search command late in a query (that is, other than as the generating command).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

aa70627
Communicator

-

0 Karma

patrickhemmer
Engager

Why you say that? Been using it for about 9 years now.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's not possible to override the built-in SPL commands.  Even if you could, it may break the behavior of the search command late in a query (that is, other than as the generating command).

---
If this reply helps you, Karma would be appreciated.
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...