Splunk Enterprise

How do I handle multivalues by splunk custom search command under Search Command Protocol version 2.

to4kawa
Ultra Champion

https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-sort-or-reorder-a-multivalue-field/m...

I want to make this with SCPversion2, but it doesn't work.

my code:

 

#!/usr/bin/env python

import sys
from splunklib.searchcommands import dispatch, StreamingCommand, Configuration, Option, validators


@Configuration()
class mvsortCommand(StreamingCommand):
    """ sort multivalue
    """


    def stream(self, records):
        self.logger.debug('mvsortCommand: %s', self)  # logs command line

        for record in records:
            if isinstance(record[self.fieldnames[0]],(str)):
                pass

            else:
                record[self.fieldnames[0]]=sorted(record[self.fieldnames[0]])
            yield record

dispatch(mvsortCommand, sys.argv, sys.stdin, sys.stdout, __name__)

 

I think I'm not handling generators and lists correctly, but I'm not sure.
Is there a good example?

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...