Splunk Search

Add Custom Search Command to Search Help

Wiggy
Splunk Employee
Splunk Employee

How can someone add a custom search command to the list that search help pops up?

I have already added a new custom search command as shown below:

In $Splunk_home/etc/system/bin I have the following script:

CustomCommand.py

In $Splunk_home/etc/system/local/commands.conf I have the following stanza:

[CustomCommand]
filename = CustomCommand.py

In $Splunk_home/etc/system/local/authorize.conf I have the following:

[[capability::run_script_CustomCommand]

[role_admin]
run_script_CustomCommand = enabled

1 Solution

Wiggy
Splunk Employee
Splunk Employee

You must add the following stanza in $Splunk_home/etc/system/local/searchbnf.conf

[CustomCommand-command]
syntax = CustomCommand <field>
description = This is a description of my CustomCommand
usage = public

Once this is added and splunk is restarted, the command should pop up in the search help when you are typing in your relevant search.

View solution in original post

Wiggy
Splunk Employee
Splunk Employee

You must add the following stanza in $Splunk_home/etc/system/local/searchbnf.conf

[CustomCommand-command]
syntax = CustomCommand <field>
description = This is a description of my CustomCommand
usage = public

Once this is added and splunk is restarted, the command should pop up in the search help when you are typing in your relevant search.

rsathish47
Contributor

Thank you dwaddle it helped me

0 Karma

i2sheri
Communicator

Thanks a lot 🙂

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Also -- if you want to share your custom command across apps and have the help still work, you'll need to update the app's default.meta or local.meta to add an entry for searchbnf as follows:

[searchbnf]
export = system
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...