Splunk Search

How can I make a new column and add values while streaming input and iterating through the results?

annalisefolsen
Explorer

I am making a python program where I am streaming in data and iterating through the results. I would like to make a new column and add results depending on the values I collect in my stream. I have already successfully completed streaming my data, but would like to now add data to each particular results. How would I go about this? I have not seen anything in the streaming documentation about changing the data. So far, I can present the results in a table, but it will not allow me to permanently add these. Thank you in advance!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If you are reading indexed events from Splunk then there is no way to modify those events.

If you are reading events from some external source then the "Does something with event" bit your code can do anything it wants to before sending the event to Splunk for indexing. You easily do event += "interesting=yes" to add a field called "interesting" to each event.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you are reading indexed events from Splunk then there is no way to modify those events.

If you are reading events from some external source then the "Does something with event" bit your code can do anything it wants to before sending the event to Splunk for indexing. You easily do event += "interesting=yes" to add a field called "interesting" to each event.

---
If this reply helps you, Karma would be appreciated.
0 Karma

annalisefolsen
Explorer

Sorry, I'm new to Splunk. How do I tell if I am reading indexed events? I am iterating through the events and these are in the form of ordered dictionaries. I followed this page http://blogs.splunk.com/2014/04/14/building-custom-search-commands-in-python-part-i-a-simple-generat... but used the streaming command. Inside I iterate through the results as I show above.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Only you know the source of your events, but if you're following the model in the blog then you are not reading indexed events.

---
If this reply helps you, Karma would be appreciated.
0 Karma

woodcock
Esteemed Legend

You need to be WAAAAAAAAAY more specific. What do you mean by add (add to what/where)? Where are you iterating (in SPL? External to splunk after having run a remote search)?

0 Karma

annalisefolsen
Explorer

I would like to add a new field, an "interesting field" to put my new data in. I will add a one word value to this field for each event I am passed and iterate through. nIs there a way to send this info back from the streaming method that changes the value of the events permanently in Splunk? I am iterating through the command by using the default streaming class example and using a stream function like:

@Configuration()
class myCommand(StreamingCommand):
def stream(self, events):
for event in events:
#Does something with event
yield{'found': "Success"}
dispatch(myCommand, sys.argv, sys.stdin, sys.stdout, name)

My script is in Python. Thanks for any help!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...