Splunk Search

How can i extract a field from my custom search command through a conf file ?

New Member

Hello splunkers,
I've got PEM encoded value from SSL certificates that are already indexed.
I've made a python custom search command to display a decoded part of my value : the "not before" date of my x509 certificate.
The extraction works through the search command, but i couldn't manage to make it work through a conf file.
Could anyone help me through this.
Thank you.

0 Karma

SplunkTrust
SplunkTrust

There currently is no way to extend the eval command with custom functions, and I don't know of a way to run a custom search command as a configured field extraction.

One possible approach could be a scripted lookup - those allow you to run a piece of python on some fields from your result, and return fields of its own. You should be able to pass your encoded field into there, decode, and pass some output back up.

0 Karma

New Member

Thks a lot Martin, that is exactly the conclusion to which i've come.
I gave up the idea of using my custom search command through a conf file and looking towards the external lookup process, which, as you say yourself could be the response to my problem.
Thks again for the thinking and suggestion, i'll let everyone know as soon as i get through to my work.

0 Karma

SplunkTrust
SplunkTrust

What do you mean by "make it work through a conf file"?
Are you trying to run a custom search command to extract a field?

0 Karma

New Member

Execute it as i would with an eval command.
Yes I'm trying to run a custom search command to extract a field.

0 Karma