https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-sort-or-reorder-a-multivalue-field/m...
I want to make this with SCPversion2, but it doesn't work.
my code:
#!/usr/bin/env python
import sys
from splunklib.searchcommands import dispatch, StreamingCommand, Configuration, Option, validators
@Configuration()
class mvsortCommand(StreamingCommand):
""" sort multivalue
"""
def stream(self, records):
self.logger.debug('mvsortCommand: %s', self) # logs command line
for record in records:
if isinstance(record[self.fieldnames[0]],(str)):
pass
else:
record[self.fieldnames[0]]=sorted(record[self.fieldnames[0]])
yield record
dispatch(mvsortCommand, sys.argv, sys.stdin, sys.stdout, __name__)
I think I'm not handling generators and lists correctly, but I'm not sure.
Is there a good example?