Splunk Search

where is the custom command documentation?

MonkeyK
Builder

Lots of custom commands come with Splunk. 31 in the search app alone.

I often see all of those commands and wonder if there is anything that I could be using. Since I am not an admin on the system, I can't just look at the code to find out.

Is there a place that documents what these commands do and what sort of arguments they expect?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

All of the commands shipped with the Search & Reporting app are documented in the Search Reference Manual (https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/WhatsInThisManual).

Where are you getting the count of custom commands?

---
If this reply helps you, Karma would be appreciated.

MonkeyK
Builder

"Settings|Advanced Search"
"Search Commands"
lists the number of commands that are showing.

some of these are clearly common search commands (head, diff). Others I see no documentation on how to use.
For example:
https://docs.splunk.com/Special:SplunkSearch/docs?q=arulespy
https://docs.splunk.com/Special:SplunkSearch/docs?q=createrss
https://docs.splunk.com/Special:SplunkSearch/docs?q=mocknodegraph

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't recognize any of those commands. I suspect they either came with an app or were produced locally. In the case of the former, consult the app docs or the developer; for the latter case, check with the owner.

---
If this reply helps you, Karma would be appreciated.
0 Karma

MonkeyK
Builder

Well. In the custom commands listing that I described how to find, these commands are listed as part of the search app with an owner of "no owner"

I consulted the app documentation as shown by the links above.

I guess that's why I asked the question that I did.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That a command is found in the Search app does not necessarily mean it came with that app. It's easy to add commands and other knowledge objects to the standard apps.

Have you tried looking in the command's script file to see if there are comments or if you can see what the code does?

---
If this reply helps you, Karma would be appreciated.
0 Karma

MonkeyK
Builder

Where in the UI do I find the command's script file? Where do I see the command ownership info?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...