Splunk Search

How can I pass a list of parameters to a custom Generating command to iterate over and generate events?

umairahmad3985
Path Finder

I have written my own custom generating command in Splunk which connects to our API and fetches threat details of a domain/ip. The syntax of the command is as follows:

| snxhostreputation host=

e.g. snxhostreputation host=www.google.com

This command generates one event for one domain but what I want to achieve is that, I should be able to pass multiple domains to this generating command and correspondingly generate events on each request to the API. The intended use-case is that users should be able to pass all domains present in their log data and get the information in the form of events. Now, as the generating command must be the very first command in a search, I cannot use any other command behind it to pass it data.

What can I do to achieve my use-case? So far, I have considered changing it to a streaming search command but I am not sure how would I achieve the same there as I also want the command to work for a single value as well as a list of values. Any tips to achieve this?

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...