Error occured during do run "Custom search command example"

[jkjeong]

I do exercise example about "Custom search command" step by step ,

but the following error occurred. What's the problem?

bin/splunk search "linecount>1 | shape | top shape"
FATAL: Error in 'shape' command: You must provide a field argument****

example line:

http://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Customsearchcommandshape

and this example is Version 1 using the intersplunk.py SDL, is there the "Version 2" example ?

[whrg]

I encountered the very same error. I was following this guide: https://www.splunk.com/en_us/blog/tips-and-tricks/write-your-own-search-language.html

What I noticed was that this guide is from 2008. Newer version of Splunk already have a built-in "shape" command. This one is defined in etc/system/default/searchbnf.conf:

[shape-command]
syntax = shape <field> (maxvalues=<int>)? (maxresolution=<int>)?
shortdesc = Produces a symbolic 'shape' attribute describing the shape of a numeric multivalued field.

Apparently, the built-in shape command takes precedence over your custom shape command when running a search.

So I suggest rename your "shape" command to "shape2" or something else.

[irsysintegratio]

Replace the first "shape" with "script shape". ,