Hi MuS, I thought that Intersplunk could change the event data when it is output (and not just display). I have done this and nothing has changed. Is this possible, or do I have to find another way to do this? Thanks again for your help! ... View more

Sorry, I'm new to Splunk. How do I tell if I am reading indexed events? I am iterating through the events and these are in the form of ordered dictionaries. I followed this page http://blogs.splunk.com/2014/04/14/building-custom-search-commands-in-python-part-i-a-simple-generating-command/ but used the streaming command. Inside I iterate through the results as I show above. ... View more

I would like to add a new field, an "interesting field" to put my new data in. I will add a one word value to this field for each event I am passed and iterate through. nIs there a way to send this info back from the streaming method that changes the value of the events permanently in Splunk? I am iterating through the command by using the default streaming class example and using a stream function like: @Configuration() class myCommand(StreamingCommand): def stream(self, events): for event in events: #Does something with event yield{'found': "Success"} dispatch(myCommand, sys.argv, sys.stdin, sys.stdout, name) My script is in Python. Thanks for any help! ... View more

Thank you. I've run it in Splunk and it is now able to find module. ... View more

Hi MuS, I tried to import Intersplunk, but it can't find the import (the module cannot be found). Is there a special download that you need other than the SDK? Also, if you can direct me to more information on this module that would be wonderful! I have not been able to find any documentation so far. Thank you! ... View more