Splunk Search

Can I get an external script to run on events while they are being calculated?

andrewtrobec
Motivator

Hello all,

I'm not sure I know how to phrase this question properly, but I will try my best.

I'm currently trying to use an external script to remove values from a list being generated by my search. Assuming that I have fields add and remove calculated, it's easy to add to the list since all I need to do is use | streamstats current=f values(add) as currentList and I'll have a running list. Since there is no way to remove values using streamstats (at least that I know of), I'm using an external script to do so:

* | script myScript currentList remove

What I've noticed is that the results being passed to the script are the entire search output, so any removed values in one event are not propagated to successive events. Is there any way of calling the script on an event basis rather than as a post process?

Best regards,

Andrew

Tags (1)
0 Karma

micahkemp
Champion

Can you just have your search filter those events before returning them?

remove

Instead of

*

Streamstats doesn't remove anything from the search pipeline, it adds to the existing events, so it seems like an inefficient method to accomplish what you're trying.

0 Karma

HiroshiSatoh
Champion

Can I delete it with this search sentence?

|streamstats count by add|where count>1|delete
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...