From Splunk search results run external command on the field

[msrama5]

Hello, I want from Splunk search results run external command on the field and return results back to splunk, following is the query

splunk query -> index="test" sourcetype=_json | xmlkv | fields httpRequestBody | table httpRequestBody

HttpRequestBody is json request, I want to run xsd validator which I already have on the json using external tool and return the results of the validator back to splunk, any advice on how can this be done ?

[efavreau]

An alternative to ingesting the data twice into Splunk, might be validate the data before it is sent to Splunk.

[richgalloway]

See https://dev.splunk.com/enterprise/docs/developapps/customsearchcommands/ for how to create an external command in Splunk.
Once you've created your command, you will have to get it approved for use in Splunk Cloud. File a support ticket for that.