Splunk Search

Add Custom Search Command to Search Help

Wiggy
Splunk Employee
Splunk Employee

How can someone add a custom search command to the list that search help pops up?

I have already added a new custom search command as shown below:

In $Splunk_home/etc/system/bin I have the following script:

CustomCommand.py

In $Splunk_home/etc/system/local/commands.conf I have the following stanza:

[CustomCommand]
filename = CustomCommand.py

In $Splunk_home/etc/system/local/authorize.conf I have the following:

[[capability::run_script_CustomCommand]

[role_admin]
run_script_CustomCommand = enabled

1 Solution

Wiggy
Splunk Employee
Splunk Employee

You must add the following stanza in $Splunk_home/etc/system/local/searchbnf.conf

[CustomCommand-command]
syntax = CustomCommand <field>
description = This is a description of my CustomCommand
usage = public

Once this is added and splunk is restarted, the command should pop up in the search help when you are typing in your relevant search.

View solution in original post

Wiggy
Splunk Employee
Splunk Employee

You must add the following stanza in $Splunk_home/etc/system/local/searchbnf.conf

[CustomCommand-command]
syntax = CustomCommand <field>
description = This is a description of my CustomCommand
usage = public

Once this is added and splunk is restarted, the command should pop up in the search help when you are typing in your relevant search.

rsathish47
Contributor

Thank you dwaddle it helped me

0 Karma

i2sheri
Communicator

Thanks a lot 🙂

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Also -- if you want to share your custom command across apps and have the help still work, you'll need to update the app's default.meta or local.meta to add an entry for searchbnf as follows:

[searchbnf]
export = system
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...