Splunk Search

Using the Splunk Python SDK, how do I get my custom generating search command to use the result of a subsearch as parameter?

kierencrossland
Path Finder

I am in the process of writing a custom command using the Python SDK. It is a generating command.

I would like the command to be able to process the result of a subsearch as a parameter, much like the search command does, ie:

"| gencmd [search some stuff | table field_of_interest]"

It looks like the SearchCommandParser in the SDK is unable to parse the output for the subsearch. So perhaps I'd be better off using InterSplunk? Does anyone know if it is possible using that instead? Or if there is a way to still use the SDK?

0 Karma
1 Solution

kierencrossland
Path Finder

Just in case anyone comes across this, I ended up dropping the SDK and just using the Intersplunk module which allows you to parse the script parameters manually.

For my purposes it was as simple as the code below, which does strip out some info like if the args have been linked by AND or OR, but this doesn't really affect what I was doing.

for arg in sys.argv:
        match = re.match(r'\s*(\S+?)\s*=\s*(\S+)', arg)

        if match:
                field = match.group(1)
                value = match.group(2)

View solution in original post

0 Karma

kierencrossland
Path Finder

Just in case anyone comes across this, I ended up dropping the SDK and just using the Intersplunk module which allows you to parse the script parameters manually.

For my purposes it was as simple as the code below, which does strip out some info like if the args have been linked by AND or OR, but this doesn't really affect what I was doing.

for arg in sys.argv:
        match = re.match(r'\s*(\S+?)\s*=\s*(\S+)', arg)

        if match:
                field = match.group(1)
                value = match.group(2)
0 Karma
Get Updates on the Splunk Community!

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...