Splunk Search

Issed when search with script from OpenSearch

kietluu
New Member

I tried to search data with dynamic script:

 

| ecs "opensearch_dashboards_sample_data_flights" "{
\"from\": 0,
\"size\": 1000,
\"query\": {
\"match_all\": {}
},
\"script_fields\": {
\"fields\": {
\"script\": {
\"source\": \\\"def fields = params['_source'].keySet(); def result = new HashMap(); for (field in fields) { def value = params['_source'][field]; if (value instanceof String && value.contains('DE')) { result.put(field, value.replace('DE', 'Germany')); } else { result.put(field, value); }} return result;\\\"
}
}
},
\"track_total_hits\": true
}" "only" | table *

 

But it not working. I think the problem is from my source command, but I don't know how to fix this

 

\"source\": \\\"def fields = params['_source'].keySet(); def result = new HashMap(); for (field in fields) { def value = params['_source'][field]; if (value instanceof String && value.contains('DE')) { result.put(field, value.replace('DE', 'Germany')); } else { result.put(field, value); }} return result;\\\" 

 

 Hope someone can help me fix this. Thank very much for speding tim for my issue.

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

"ecs" is not a native Splunk command. Whatever add-on it came from you need to look in its docs. The only Splunk-related thing is that the string which apparently contains some command for external service must be properly escaped. Other than that it's beyond Splunk realm.

0 Karma

kietluu
New Member

@PickleRick thank you 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...