Splunk Enterprise

Custom Search Reporting Command

cave_dweller
Observer

Hello,

I am having an issue with piping the output of a custom reporting command, as documented here, into another SPL command. I can get the basic reporting command example to work. It's called "sum" and is provided within the "searchcommands_app" directory of the Splunk Python SDK hosted on GitHub. However, once I get statistics output from the "sum" command, I cannot pipe those results into another command.

This first query works fine:

 

index = _internal | head 200 | sum total=lines linecount

 

However, this query does not work:

 

index = _internal | head 400 | sum total=lines linecount | stats count

 

When I try to pipe the output of the "sum" command into the "stats" command, I get the following error:

 

KeyError at "/opt/splunk/etc/apps/t-digest-custom-command/bin/sum.py", line 63 : 'linecount'

 

Am I getting this error due to a bug in the custom search command API, or am I missing something?

Thanks,

 

Follow up question: why don't reporting commands reduce to a single value for sufficiently large numbers of input events? For example, this query yields a single statistic value as I expect:

 

index = _internal | head 50 | sum total=lines linecount

 

However, this query yields multiple statistic values, even when I only want one value:

 

index = _internal | head 400 | sum total=lines linecount

 

 

 

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...