Splunk Dev

Why am I unable to pass field values as arguments for my custom search command?

wandrilleD
Engager

Hello,

I recently created a custom search command allowing me to output results of a search directly to hdfs via webhdfs.

After some time trying to figure out the Python SDK, I've finally managed to achieve my purpose.

My command work as follow:

[splunk search] | outputhdfs [path/to/hdfs/] [fileName] [fields_to_export] [separator]

What I'd like to do is to pass a field value, such as a date or something, as my fileName, but it doesn't seem to work

like when i do :

[splunk_search] |eval datePart = strftime(s_cnxTime,"%Y%m%d") | outputhdfs path="/tmp/outputhdfs/" file=datePart fields="KeyID, ConnexionTime, Suspect, Time_Transfert" separator="#"

it creates a file named datePart at the specified path.

If you have any ideas 😉

Regards,
Wandrille

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

Although, I am not sure why your command is not working, I was wandering why not just use the Splunk Supported App - hadoop connect - to Export search results into HDFS?
Here is the link to the function in hadoop connect that seems to do the same as outputhdfs : http://docs.splunk.com/Documentation/HadoopConnect/1.2.3/DeployHadoopConnect/ExporttoHDFS

0 Karma

wandrilleD
Engager

The command works, we didn't use the export from hadoop connect because we needed a custom command anyway, the question here only concerns the problem to pass a date as an argument of the custom command.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...