Splunk Search

How can I make a new column and add values while streaming input and iterating through the results?

annalisefolsen
Explorer

I am making a python program where I am streaming in data and iterating through the results. I would like to make a new column and add results depending on the values I collect in my stream. I have already successfully completed streaming my data, but would like to now add data to each particular results. How would I go about this? I have not seen anything in the streaming documentation about changing the data. So far, I can present the results in a table, but it will not allow me to permanently add these. Thank you in advance!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If you are reading indexed events from Splunk then there is no way to modify those events.

If you are reading events from some external source then the "Does something with event" bit your code can do anything it wants to before sending the event to Splunk for indexing. You easily do event += "interesting=yes" to add a field called "interesting" to each event.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you are reading indexed events from Splunk then there is no way to modify those events.

If you are reading events from some external source then the "Does something with event" bit your code can do anything it wants to before sending the event to Splunk for indexing. You easily do event += "interesting=yes" to add a field called "interesting" to each event.

---
If this reply helps you, Karma would be appreciated.
0 Karma

annalisefolsen
Explorer

Sorry, I'm new to Splunk. How do I tell if I am reading indexed events? I am iterating through the events and these are in the form of ordered dictionaries. I followed this page http://blogs.splunk.com/2014/04/14/building-custom-search-commands-in-python-part-i-a-simple-generat... but used the streaming command. Inside I iterate through the results as I show above.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Only you know the source of your events, but if you're following the model in the blog then you are not reading indexed events.

---
If this reply helps you, Karma would be appreciated.
0 Karma

woodcock
Esteemed Legend

You need to be WAAAAAAAAAY more specific. What do you mean by add (add to what/where)? Where are you iterating (in SPL? External to splunk after having run a remote search)?

0 Karma

annalisefolsen
Explorer

I would like to add a new field, an "interesting field" to put my new data in. I will add a one word value to this field for each event I am passed and iterate through. nIs there a way to send this info back from the streaming method that changes the value of the events permanently in Splunk? I am iterating through the command by using the default streaming class example and using a stream function like:

@Configuration()
class myCommand(StreamingCommand):
def stream(self, events):
for event in events:
#Does something with event
yield{'found': "Success"}
dispatch(myCommand, sys.argv, sys.stdin, sys.stdout, name)

My script is in Python. Thanks for any help!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...