Splunk Search
Highlighted

How do you run a script on a column search result?

New Member

Hi,

I want to run a script on all values in a column like that:

index="myindex" mysearch_filters | table id | script call_script $id

My py script works when I call |script call_script id1 but I want to do it for every values pf id.
I tried a lot of things without success (using foreach, map, ...).
Can someone tell me how to do that ? Or give me some guidelines ?

Thanks.

Rémy

0 Karma
Highlighted

Re: How do you run a script on a column search result?

Legend

@rolivet can you try with a rather expensive map command? Following example will iterate for 10 ids from the table and then run the script for each id:

index="myindex" mysearch_filters 
| table id 
| map search="| script call_script $id$" maxsearches=10



| eval message="Happy Splunking!!!"


0 Karma