Splunk Search

Error occured during do run "Custom search command example"

jkjeong
New Member

I do exercise example about "Custom search command" step by step ,

but the following error occurred. What's the problem?

bin/splunk search "linecount>1 | shape | top shape"
FATAL: Error in 'shape' command: You must provide a field argument****

example line:

http://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Customsearchcommandshape

and this example is Version 1 using the intersplunk.py SDL, is there the "Version 2" example ?

Tags (2)
0 Karma

whrg
Motivator

I encountered the very same error. I was following this guide: https://www.splunk.com/en_us/blog/tips-and-tricks/write-your-own-search-language.html

What I noticed was that this guide is from 2008. Newer version of Splunk already have a built-in "shape" command. This one is defined in etc/system/default/searchbnf.conf:

 

[shape-command]
syntax = shape <field> (maxvalues=<int>)? (maxresolution=<int>)?
shortdesc = Produces a symbolic 'shape' attribute describing the shape of a numeric multivalued field.

Apparently, the built-in shape command takes precedence over your custom shape command when running a search.

So I suggest rename your "shape" command to "shape2" or something else.

0 Karma

irsysintegratio
Path Finder

Replace the first "shape" with "script shape". ,

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...