Splunk Dev

custom command : how to append dynamically columns

sbsbb
Builder

I try to write a python command that generates results.
My problem is, that I have "n" columns, and the name of them is might be different from line to line. I can't make it with the normal results.append/outputresult

    results.append({'_time' : time, '_raw' : output})   
    si.outputResults(results)

How could I do that, it there a way to append line by line, with the columns defined in variables ?

append["line1"]
    appendcol["_time"]=time
    appendcol[r]=rr
    appendcol[s]=ss
append["line2"]
    appendcol["_time"]=time
    appendcol[x]=xx
    appendcol[y]=yy
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Of course can you use append and outputresults, and I'm assuming you're using InterSplunk libraries. results is simply a python list of dicts. You can append and add whatever you want to such a list:

results.append({'_time': time, '_raw': output, 'r' : rr, 's': ss})
results.append({'_time': time, '_raw': output, 'x' : xx, 'y': yy})

and there are many other ways to work with lists and dictss:

http://docs.python.org/2.7/library/stdtypes.html#sequence-types-str-unicode-list-tuple-bytearray-buf...
http://docs.python.org/2.7/library/stdtypes.html#mapping-types-dict

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Of course can you use append and outputresults, and I'm assuming you're using InterSplunk libraries. results is simply a python list of dicts. You can append and add whatever you want to such a list:

results.append({'_time': time, '_raw': output, 'r' : rr, 's': ss})
results.append({'_time': time, '_raw': output, 'x' : xx, 'y': yy})

and there are many other ways to work with lists and dictss:

http://docs.python.org/2.7/library/stdtypes.html#sequence-types-str-unicode-list-tuple-bytearray-buf...
http://docs.python.org/2.7/library/stdtypes.html#mapping-types-dict

0 Karma

sbsbb
Builder

I was able to make it work :
result={'_time': ttime} # getting the time field in the result row
result[ host]=str(m.getElementsByTagName('metricValue')[0].firstChild.data) #append new column in result row
results.append(result) # append result_row in results array
si.outputResults(results) # output all results

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Well, then you would use r instead of 'r'. There are many excellent online tutorials of Python that can explain how the basic constructs and syntax work.

0 Karma

sbsbb
Builder

Thank you, but in taht case I assume the column name is fix to 'r' and 'x'. I would like to read it from a variable.

If you have a small example it would help, I'm not familiar to programming, to I don't know what I need to search for it the docs...

Many thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...