How can i extract a field from my custom search command through a conf file ?

[phbourrel]

Hello splunkers,
I've got PEM encoded value from SSL certificates that are already indexed.
I've made a python custom search command to display a decoded part of my value : the "not before" date of my x509 certificate.
The extraction works through the search command, but i couldn't manage to make it work through a conf file.
Could anyone help me through this.
Thank you.

[martin_mueller]

There currently is no way to extend the eval command with custom functions, and I don't know of a way to run a custom search command as a configured field extraction.

One possible approach could be a scripted lookup - those allow you to run a piece of python on some fields from your result, and return fields of its own. You should be able to pass your encoded field into there, decode, and pass some output back up.

[phbourrel]

Thks a lot Martin, that is exactly the conclusion to which i've come.
I gave up the idea of using my custom search command through a conf file and looking towards the external lookup process, which, as you say yourself could be the response to my problem.
Thks again for the thinking and suggestion, i'll let everyone know as soon as i get through to my work.

[martin_mueller]

What do you mean by "make it work through a conf file"?
Are you trying to run a custom search command to extract a field?

[phbourrel]

Execute it as i would with an eval command.
Yes I'm trying to run a custom search command to extract a field.