I seem to have solved the issue by piping the data to a fields command before piping to the custom search command. Not sure why that has made a difference but it is working now Thanks for your help Adam ... View more

Ok thanks, that's interesting. It might be an option, but I was wondering if there's a way to get the python script working (I inherited the majority of the code needed to do the decoding so would rather not recreate the logic if I can avoid it) I've had a dig around and if put localop in between specifying the index and the custom search command then it does work in dashboards. So presumably the custom search is being executed on the search head. Any idea how to find out why it won't work on our indexer? Thanks Adam ... View more

I've ingested the JSON data using indexed extractions, so phyPayload appears as an event field. The custom search command is a python script that I developed using the python SDK/splunklib . The custom search command is called abeeway_decoder, so my search is just index=myindex | abeeway_decoder I don't think it's possible to extract the payload using "standard" search commands, but I may be wrong. The Python script converts the hex string into a byte array and then does does some binary operations on the byte values. Is this possible? ... View more

Here's an example message from a device. The search command decodes phyPayload: {     "id": "5f44141360bac5000165f58e",     "devEui": "redacted",     "date": 1598297107124,     "direction": "Uplink",     "type": "UnconfirmedDataUp",     "phyPayload": "40d267000280d5131147cdc99ff4beaeeda9e9",     "radioParameters": [         {             "freq": 867.9,             "modulation": "LORA",             "dataRate": "SF7BW125",             "codingRate": "4/5"         }     ],     "ack": false,     "fCnt": 5077,     "macCommand": null,     "fPort": 17,     "gwInfo": [         {             "gwEui": "redacted",             "rfRegion": null,             "rssi": -91,             "snr": 10.5,             "latitude": null,             "longitude": null,             "altitude": null,             "channel": null,             "radioId": null,             "rssis": null,             "rssisd": null,             "fineTimestamp": null,             "antenna": null,             "frequencyOffset": null         },         {             "gwEui": "redacted",             "rfRegion": null,             "rssi": -46,             "snr": 8.5,             "latitude": null,             "longitude": null,             "altitude": null,             "channel": null,             "radioId": null,             "rssis": null,             "rssisd": null,             "fineTimestamp": null,             "antenna": null,             "frequencyOffset": null         }     ],     "delayed": false,     "classB": false,     "encodingType": "HEXA" }   The search I am testing just specifies the index, and pipes to the custom search command. It returns events when run as a search  ... View more