Splunk Dev

Splunk custom search command : call other splunk commands

alfreddupont012
Engager

Hi all,

 

I have created a custom search command that need some preformated input. To do so, I always run my command with the same splunk commands before :

...
| eval a=b+c
| stats count by a
| bin ...
| my_custom_command(count,a,b,c)

Hence, i have created a macro to wrap all this code, so I only have to call my macro :

... | `my_macro(b,c)`

The problem is because it is a macro, it does not have the description of the searchbnf.conf for "my_custom_command".

 

So I would like to edit the code of "my_custom_command" to "embed" the splunk commands i always run  (the stats, bin, eval connands) before running my own code. Is there a way to do so ?
If no, is there a way to create a searchbnf for a macro ?

Labels (2)
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...