Trying out on custom command search

[sarahh]

Hello,

I've entered "print 'Hello World'" in helloworld.py file for custom command. I also added authorize.conf & commands.conf into $SPLUNK_HOME\etc\system\local\ directory with the stanzas needed and thereafter restarted Splunk. However, when I typed "|helloworld" into the search bar, "Hello World" didnt get printed out onto the screen. What should i do?

Thanks in advance. 🙂

[jonuwz · Accepted solution]

Take a look in etc/apps/search/bin/gentimes.py for an example of a "generating" custom command.

Just putting "print 'Hello World'" into the file is not going to work.

You need to generate a "results" array containing the field/values for each of the columns, then pass it back.

helloworld.py

import re,sys,time, splunk.Intersplunk

def hello(results, settings):
    results = []
    result = {}
    result['string'] = "Hello World"
    results.append(result)
    return results

results, dummyresults, settings = splunk.Intersplunk.getOrganizedResults()
results = hello(results, settings)
splunk.Intersplunk.outputResults(results)

commands.conf

[helloworld]
filename = helloworld.py
generating = true
supports_rawargs = true

[sarahh]

i see. thanks!! great help. 🙂

[jonuwz]

Result is a row, results is all the rows.

[sarahh]

Oh... why is there "result" and "results"?