I'm working on a streaming custom command that converts a field containing binary to a multivalue field of the binary bit values, but whenever an existing multivalue field is passed in to my command it seems to get converted to a space separated string.
def stream(self, events):
for event in events:
#skip the event if it doesn't contain the field, or the field isn't binary
if self.field not in event.keys() or re.match("^(0b)?[0-1]+$", event[self.field], re.I) is None:
initial = event[self.field];
event[self.field] = 
for i, c in enumerate(reversed(initial)):
if c == "0" or c == "1":
value = int(c, 2)*((2**i))
if value > 0:
except Exception, e:
if not self.suppress_error:
I've tried the sample streaming command (countmatches) in the python SDK and it seems to suffer from this issue as well.
I also read through the SDK documentation on searchcommands, and while point #8 mentions fields using the naming convention "__mv_somefieldname" for multivalue fields, the events dictionary (in my command above) never contains any fields named like this.
How can I prevent multivalue fields from losing their multivaluedness in a streaming custom command?
Further testing reveals that, while the __GETINFO__ call is indicating to Splunk that multivalues are supported: