Splunk Search

Add Custom Search Command to Search Help

Wiggy
Splunk Employee
Splunk Employee

How can someone add a custom search command to the list that search help pops up?

I have already added a new custom search command as shown below:

In $Splunk_home/etc/system/bin I have the following script:

CustomCommand.py

In $Splunk_home/etc/system/local/commands.conf I have the following stanza:

[CustomCommand]
filename = CustomCommand.py

In $Splunk_home/etc/system/local/authorize.conf I have the following:

[[capability::run_script_CustomCommand]

[role_admin]
run_script_CustomCommand = enabled

1 Solution

Wiggy
Splunk Employee
Splunk Employee

You must add the following stanza in $Splunk_home/etc/system/local/searchbnf.conf

[CustomCommand-command]
syntax = CustomCommand <field>
description = This is a description of my CustomCommand
usage = public

Once this is added and splunk is restarted, the command should pop up in the search help when you are typing in your relevant search.

View solution in original post

Wiggy
Splunk Employee
Splunk Employee

You must add the following stanza in $Splunk_home/etc/system/local/searchbnf.conf

[CustomCommand-command]
syntax = CustomCommand <field>
description = This is a description of my CustomCommand
usage = public

Once this is added and splunk is restarted, the command should pop up in the search help when you are typing in your relevant search.

rsathish47
Contributor

Thank you dwaddle it helped me

0 Karma

i2sheri
Communicator

Thanks a lot 🙂

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Also -- if you want to share your custom command across apps and have the help still work, you'll need to update the app's default.meta or local.meta to add an entry for searchbnf as follows:

[searchbnf]
export = system
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...