Splunk Search

Add Custom Search Command to Search Help

Wiggy
Splunk Employee
Splunk Employee

How can someone add a custom search command to the list that search help pops up?

I have already added a new custom search command as shown below:

In $Splunk_home/etc/system/bin I have the following script:

CustomCommand.py

In $Splunk_home/etc/system/local/commands.conf I have the following stanza:

[CustomCommand]
filename = CustomCommand.py

In $Splunk_home/etc/system/local/authorize.conf I have the following:

[[capability::run_script_CustomCommand]

[role_admin]
run_script_CustomCommand = enabled

1 Solution

Wiggy
Splunk Employee
Splunk Employee

You must add the following stanza in $Splunk_home/etc/system/local/searchbnf.conf

[CustomCommand-command]
syntax = CustomCommand <field>
description = This is a description of my CustomCommand
usage = public

Once this is added and splunk is restarted, the command should pop up in the search help when you are typing in your relevant search.

View solution in original post

Wiggy
Splunk Employee
Splunk Employee

You must add the following stanza in $Splunk_home/etc/system/local/searchbnf.conf

[CustomCommand-command]
syntax = CustomCommand <field>
description = This is a description of my CustomCommand
usage = public

Once this is added and splunk is restarted, the command should pop up in the search help when you are typing in your relevant search.

rsathish47
Contributor

Thank you dwaddle it helped me

0 Karma

i2sheri
Communicator

Thanks a lot 🙂

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Also -- if you want to share your custom command across apps and have the help still work, you'll need to update the app's default.meta or local.meta to add an entry for searchbnf as follows:

[searchbnf]
export = system
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...