How can I make a new column and add values while streaming input and iterating through the results?

[annalisefolsen]

I am making a python program where I am streaming in data and iterating through the results. I would like to make a new column and add results depending on the values I collect in my stream. I have already successfully completed streaming my data, but would like to now add data to each particular results. How would I go about this? I have not seen anything in the streaming documentation about changing the data. So far, I can present the results in a table, but it will not allow me to permanently add these. Thank you in advance!

[richgalloway · Accepted solution]

If you are reading indexed events from Splunk then there is no way to modify those events.

If you are reading events from some external source then the "Does something with event" bit your code can do anything it wants to before sending the event to Splunk for indexing. You easily do event += "interesting=yes" to add a field called "interesting" to each event.

[annalisefolsen]

Sorry, I'm new to Splunk. How do I tell if I am reading indexed events? I am iterating through the events and these are in the form of ordered dictionaries. I followed this page http://blogs.splunk.com/2014/04/14/building-custom-search-commands-in-python-part-i-a-simple-generat... but used the streaming command. Inside I iterate through the results as I show above.

[richgalloway]

Only you know the source of your events, but if you're following the model in the blog then you are not reading indexed events.

[woodcock]

You need to be WAAAAAAAAAY more specific. What do you mean by add (add to what/where)? Where are you iterating (in SPL? External to splunk after having run a remote search)?

[annalisefolsen]

I would like to add a new field, an "interesting field" to put my new data in. I will add a one word value to this field for each event I am passed and iterate through. nIs there a way to send this info back from the streaming method that changes the value of the events permanently in Splunk? I am iterating through the command by using the default streaming class example and using a stream function like:

@Configuration()
class myCommand(StreamingCommand):
def stream(self, events):
for event in events:
#Does something with event
yield{'found': "Success"}
dispatch(myCommand, sys.argv, sys.stdin, sys.stdout, name)

My script is in Python. Thanks for any help!