Help on custom command (Examples needed)

[sarahh]

Hi,

May I ask if there is any steps on how can you have your custom command take in the search results of "x|custom command"? So that when you "x|custom command", the search results of "x" will be able to be printed out on the results panel.
For example, your custom command is to print out "Testing123" on the results panel. However, when you typed "source_type|custom command", it will print out "Testing123" and at the same time also the results of "source_type". Is there any examples or steps that I can follow so that I know what can I change in my python file?
Thanks in advance!

[jonuwz]

Custom command : 'addcustomfield.py'

import re,sys,time, splunk.Intersplunk

def doaddfield(results, settings):

  try:
    # get list of fields, and hash of arguments
    fields, argvals = splunk.Intersplunk.getKeywordsAndOptions()
    # set test message if "message" is not defined
    message         = argvals.get("message","Testing 123")

    # for each result, add fields set to message
    for r in results:
      for f in fields:
        r[f] = message

    # return the results
    splunk.Intersplunk.outputResults(results)

  except:
    import traceback
    stack =  traceback.format_exc()
    results = splunk.Intersplunk.generateErrorResults("Error : Traceback: " + str(stack))

results, dummyresults, settings = splunk.Intersplunk.getOrganizedResults()
results = doaddfield(results, settings)

commands.conf

[addcustomfield]
retainsevents = true
streaming = true
filename = addcustomfield.py

usage :

... | addcustomfield myfield message="blah blah blah"

[jonuwz]

You asked for an example where new fields are added to the existing result set. Thats exactly what the above does.

The "..." Is a search I.e sourcetype=syslog . then you can do | addcustomfield myfield to add myfiled to the list of fields.

If you want to hard code these in the example above, change the default message, and hard code "f"

[sarahh]

Hi,
But what i wanted was " myfield message="blah" | addcustomfield " instead of "... | addcustomfield myfield message="blah" "

[Damien_Dallimor]

Care to post your custom command's python code ?