Splunk Enterprise

Custom Search Reporting Command

cave_dweller
Observer

Hello,

I am having an issue with piping the output of a custom reporting command, as documented here, into another SPL command. I can get the basic reporting command example to work. It's called "sum" and is provided within the "searchcommands_app" directory of the Splunk Python SDK hosted on GitHub. However, once I get statistics output from the "sum" command, I cannot pipe those results into another command.

This first query works fine:

 

index = _internal | head 200 | sum total=lines linecount

 

However, this query does not work:

 

index = _internal | head 400 | sum total=lines linecount | stats count

 

When I try to pipe the output of the "sum" command into the "stats" command, I get the following error:

 

KeyError at "/opt/splunk/etc/apps/t-digest-custom-command/bin/sum.py", line 63 : 'linecount'

 

Am I getting this error due to a bug in the custom search command API, or am I missing something?

Thanks,

 

Follow up question: why don't reporting commands reduce to a single value for sufficiently large numbers of input events? For example, this query yields a single statistic value as I expect:

 

index = _internal | head 50 | sum total=lines linecount

 

However, this query yields multiple statistic values, even when I only want one value:

 

index = _internal | head 400 | sum total=lines linecount

 

 

 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...