StreamingCommand Inappropriately Removes Leading Spaces

[malvidin]

I can find a way to get results from a StreamingCommand to retain leading spaces. It doesn't matter if the field was fine before the app, it is gone afterward. Or even if the field wasn't processed by the command.

| makeresults
| eval test1 = "  "
| eval test2 = urldecode("%20%20")
| eval ok_here = if(test1==test2 AND len(test1) == 2, "true", "false")
| eval value_for_command = "nothing_special"
| customstreamingcommand field=value_for_command
| eval still_ok_here = if(test1==test2 AND len(test1) == 2, "true", "false")

In this simple case, "still_ok_here"  is false, but the same test was true before the command.

[malvidin]

I found a solution, but the problem may not be with the SDK. The SDK reads the data passed from the search command, but Splunk strips the data when passed back to Splunk.

The workaround is to modify the SDK 'splunklib.searchcommands' CSV dialect to pass the data back with csv.QUOTE_ALL in internals.py. Although this is not recommended by Splunk, it is likely preferable to modifying other Splunk internals.

[malvidin]

csv.QUOTE_NONNUMERIC also works, with potentially less overhead that csv.QUOTE_ALL