Splunk Search

Issed when search with script from OpenSearch

kietluu
New Member

I tried to search data with dynamic script:

 

| ecs "opensearch_dashboards_sample_data_flights" "{
\"from\": 0,
\"size\": 1000,
\"query\": {
\"match_all\": {}
},
\"script_fields\": {
\"fields\": {
\"script\": {
\"source\": \\\"def fields = params['_source'].keySet(); def result = new HashMap(); for (field in fields) { def value = params['_source'][field]; if (value instanceof String && value.contains('DE')) { result.put(field, value.replace('DE', 'Germany')); } else { result.put(field, value); }} return result;\\\"
}
}
},
\"track_total_hits\": true
}" "only" | table *

 

But it not working. I think the problem is from my source command, but I don't know how to fix this

 

\"source\": \\\"def fields = params['_source'].keySet(); def result = new HashMap(); for (field in fields) { def value = params['_source'][field]; if (value instanceof String && value.contains('DE')) { result.put(field, value.replace('DE', 'Germany')); } else { result.put(field, value); }} return result;\\\" 

 

 Hope someone can help me fix this. Thank very much for speding tim for my issue.

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

"ecs" is not a native Splunk command. Whatever add-on it came from you need to look in its docs. The only Splunk-related thing is that the string which apparently contains some command for external service must be properly escaped. Other than that it's beyond Splunk realm.

0 Karma

kietluu
New Member

@PickleRick thank you 

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...