Splunk Search

Error occured during do run "Custom search command example"

jkjeong
New Member

I do exercise example about "Custom search command" step by step ,

but the following error occurred. What's the problem?

bin/splunk search "linecount>1 | shape | top shape"
FATAL: Error in 'shape' command: You must provide a field argument****

example line:

http://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Customsearchcommandshape

and this example is Version 1 using the intersplunk.py SDL, is there the "Version 2" example ?

Tags (2)
0 Karma

whrg
Motivator

I encountered the very same error. I was following this guide: https://www.splunk.com/en_us/blog/tips-and-tricks/write-your-own-search-language.html

What I noticed was that this guide is from 2008. Newer version of Splunk already have a built-in "shape" command. This one is defined in etc/system/default/searchbnf.conf:

 

[shape-command]
syntax = shape <field> (maxvalues=<int>)? (maxresolution=<int>)?
shortdesc = Produces a symbolic 'shape' attribute describing the shape of a numeric multivalued field.

Apparently, the built-in shape command takes precedence over your custom shape command when running a search.

So I suggest rename your "shape" command to "shape2" or something else.

0 Karma

irsysintegratio
Path Finder

Replace the first "shape" with "script shape". ,

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>