Splunk Dev

How do I go about sending multi-lined string variables to Splunk?

dominiquevocat
SplunkTrust
SplunkTrust

splunk.intersplunk.outputResults output multiline strings in a field

I have multi-line results which I would like to output as a multi-lined text in a field.

Splunk is doing some cleaning in fields like stripping leading spaces and ignoring linefeed.
How would I go about sending multi-lined string variable to Splunk?

0 Karma
1 Solution

dominiquevocat
SplunkTrust
SplunkTrust

Simple enough... multivalue values are strings in a list

file = open(file_path,"r")

results = []
content = file.readlines()
result = {}
result["ldif"] = content
results.append(result)

file.close()
splunk.Intersplunk.outputResults(results)

View solution in original post

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

Simple enough... multivalue values are strings in a list

file = open(file_path,"r")

results = []
content = file.readlines()
result = {}
result["ldif"] = content
results.append(result)

file.close()
splunk.Intersplunk.outputResults(results)
0 Karma

Sukisen1981
Champion

Hmm this is really unclear, you need to provide us samples of what the data in splunk looks like and what you expect?

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

example:

data i would like to give back to splunk:

dn: cn=someuser,cn=people,ou=company,dc=domain,dc=com
changetype: add
cn: someuser
groupmembership: cn=group1,ou=groups,dc=domain,dc=com
groupmembership: cn=group2,ou=groups,dc=domain,dc=com

the way it looks in splunk:

dn: cn=someuser,cn=people,ou=company,dc=domain,dc=com changetype: add cn: someuser groupmembership: cn=group1,ou=groups,dc=domain,dc=com groupmembership: cn=group2,ou=groups,dc=domain,dc=com

so yeah, a multilined text is presented as a single line, stripped of linefeeds and extra whitespace.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...