Splunk Enterprise

How do I handle multivalues by splunk custom search command under Search Command Protocol version 2.

Ultra Champion


I want to make this with SCPversion2, but it doesn't work.

my code:


#!/usr/bin/env python

import sys
from splunklib.searchcommands import dispatch, StreamingCommand, Configuration, Option, validators

class mvsortCommand(StreamingCommand):
    """ sort multivalue

    def stream(self, records):
        self.logger.debug('mvsortCommand: %s', self)  # logs command line

        for record in records:
            if isinstance(record[self.fieldnames[0]],(str)):

            yield record

dispatch(mvsortCommand, sys.argv, sys.stdin, sys.stdout, __name__)


I think I'm not handling generators and lists correctly, but I'm not sure.
Is there a good example?

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...