Splunk Search

Why am I unable to set new fields in a custom search streaming command?

j8lp
Explorer

I'm writing a custom search command to convert all the full path xml names to just local names. I'm also making the field names all lower case for consistency. My code is below:

    def stream(self, records):
        for record in records:
            for fieldname in record.keys():
                if "." in fieldname and len(record[fieldname]) > 0:
                         newname = fieldname.lower().split('.')[-1]
                         record[newname] = record[fieldname]
                         record[fieldname] = None
            yield record

However, setting record[newname] only seems to work half the time. So when I run the search, I don't see all of the newname fields appearing in the events list. Am I doing something wrong?

0 Karma
1 Solution

j8lp
Explorer

Figured it out. Looks like Splunk only writes the fields that are set in the first record. So removing the len(record[fieldname]) > 0 fixed the issue:

 def stream(self, records):
     for record in records:
         for fieldname in record.keys():
             if "." in fieldname:
                      newname = fieldname.lower().split('.')[-1]
                      record[newname] = record[fieldname]
                      record[fieldname] = None
         yield record

View solution in original post

0 Karma

j8lp
Explorer

Figured it out. Looks like Splunk only writes the fields that are set in the first record. So removing the len(record[fieldname]) > 0 fixed the issue:

 def stream(self, records):
     for record in records:
         for fieldname in record.keys():
             if "." in fieldname:
                      newname = fieldname.lower().split('.')[-1]
                      record[newname] = record[fieldname]
                      record[fieldname] = None
         yield record
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...