I have the same question. Now I figure it out. I think it will help you. We misunderstand the definition of Field and Option. So we miss the important property named fieldnames that defined in splunklib/searchcommands/search_command.py Line:201 Following code is what you want. Line 8-9 @Configuration() class GenerateTextCommand(GeneratingCommand): # options ..... def generate(self): # field names count = self.fieldnames[0] text = self.fieldnames[1] for i in range(1, self.count + 1): yield {'_serial': i, '_time': time.time(), '_raw': six.text_type(i) + '. ' + text} Thank you. ... View more

Guys, thanks a lot for replies, I'd like to experiment a little bit before accepting. But I'd like to avoid to relay on exact fieldset in search 1 and 2, I'd like to have some unified approach. Means, I'd like to avoid using f3 explicitly in search. Let's imagine that fieldset for search 1 is defined in some variable, I don't know exact fieldset, it's configurable, I don't want to parse it. So the spl should be independent from what is in configuration. Also I have no _raw field, both search are came from lookup. Now all I can imagine is to search index1 twice, something like this: index=index1 | search NOT [index=index2 | search [index=index1]] ... View more