Splunk Dev

custom command : how to append dynamically columns

sbsbb
Builder

I try to write a python command that generates results.
My problem is, that I have "n" columns, and the name of them is might be different from line to line. I can't make it with the normal results.append/outputresult

    results.append({'_time' : time, '_raw' : output})   
    si.outputResults(results)

How could I do that, it there a way to append line by line, with the columns defined in variables ?

append["line1"]
    appendcol["_time"]=time
    appendcol[r]=rr
    appendcol[s]=ss
append["line2"]
    appendcol["_time"]=time
    appendcol[x]=xx
    appendcol[y]=yy
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Of course can you use append and outputresults, and I'm assuming you're using InterSplunk libraries. results is simply a python list of dicts. You can append and add whatever you want to such a list:

results.append({'_time': time, '_raw': output, 'r' : rr, 's': ss})
results.append({'_time': time, '_raw': output, 'x' : xx, 'y': yy})

and there are many other ways to work with lists and dictss:

http://docs.python.org/2.7/library/stdtypes.html#sequence-types-str-unicode-list-tuple-bytearray-buf...
http://docs.python.org/2.7/library/stdtypes.html#mapping-types-dict

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Of course can you use append and outputresults, and I'm assuming you're using InterSplunk libraries. results is simply a python list of dicts. You can append and add whatever you want to such a list:

results.append({'_time': time, '_raw': output, 'r' : rr, 's': ss})
results.append({'_time': time, '_raw': output, 'x' : xx, 'y': yy})

and there are many other ways to work with lists and dictss:

http://docs.python.org/2.7/library/stdtypes.html#sequence-types-str-unicode-list-tuple-bytearray-buf...
http://docs.python.org/2.7/library/stdtypes.html#mapping-types-dict

0 Karma

sbsbb
Builder

I was able to make it work :
result={'_time': ttime} # getting the time field in the result row
result[ host]=str(m.getElementsByTagName('metricValue')[0].firstChild.data) #append new column in result row
results.append(result) # append result_row in results array
si.outputResults(results) # output all results

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Well, then you would use r instead of 'r'. There are many excellent online tutorials of Python that can explain how the basic constructs and syntax work.

0 Karma

sbsbb
Builder

Thank you, but in taht case I assume the column name is fix to 'r' and 'x'. I would like to read it from a variable.

If you have a small example it would help, I'm not familiar to programming, to I don't know what I need to search for it the docs...

Many thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...