Splunk Search

How do I avoid using an eval for a fixed value parameter in a custom command?

andrewtrobec
Motivator

Hello,

I have a custom command, let's call it customcommand. This command takes two parameters, parameter1 and parameter2.

parameter1 should be a fixed value, fixedvalue, while parameter2 comes from a field in the search. In order to get the custom command working, I am currently using an eval before the custom command to fix the value for parameter1. It looks like this:

...
| eval parameter1 = "fixedvalue"
| customcommand parameter1 parameter2
...

Is there a way of setting parameter1 directly in the customcommand call? Something like:

| customcommand parameter1="fixedvalue" parameter2

I added supports_rawargs = true to my commands.conf, but it doesn't seem to resolve.

Can somebody point me in the right direction?

Thanks!

Andrew

0 Karma
1 Solution

andrewtrobec
Motivator

Figured it out finally, was quite obvious in the end. Anyways, here is a snippet that should help anyone who comes across the same problem. I used Intersplunk library and the difference is between a keyword and an option:

keywords, options = splunk.Intersplunk.getKeywordsAndOptions()
...
parameter1 = str(options.get("parameter1","NULL"))
parameter2 = str(result[keywords[0]])
...

Custom command can then be invoked like this:

| customcommand parameter1=fixedvalue parameter2

Hope this helps!

View solution in original post

0 Karma

andrewtrobec
Motivator

Figured it out finally, was quite obvious in the end. Anyways, here is a snippet that should help anyone who comes across the same problem. I used Intersplunk library and the difference is between a keyword and an option:

keywords, options = splunk.Intersplunk.getKeywordsAndOptions()
...
parameter1 = str(options.get("parameter1","NULL"))
parameter2 = str(result[keywords[0]])
...

Custom command can then be invoked like this:

| customcommand parameter1=fixedvalue parameter2

Hope this helps!

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...