Can I get an external script to run on events while they are being calculated?

[andrewtrobec]

Hello all,

I'm not sure I know how to phrase this question properly, but I will try my best.

I'm currently trying to use an external script to remove values from a list being generated by my search. Assuming that I have fields add and remove calculated, it's easy to add to the list since all I need to do is use | streamstats current=f values(add) as currentList and I'll have a running list. Since there is no way to remove values using streamstats (at least that I know of), I'm using an external script to do so:

* | script myScript currentList remove

What I've noticed is that the results being passed to the script are the entire search output, so any removed values in one event are not propagated to successive events. Is there any way of calling the script on an event basis rather than as a post process?

Best regards,

Andrew

[micahkemp]

Can you just have your search filter those events before returning them?

remove

Instead of

*

Streamstats doesn't remove anything from the search pipeline, it adds to the existing events, so it seems like an inefficient method to accomplish what you're trying.

[HiroshiSatoh]

Can I delete it with this search sentence?

|streamstats count by add|where count>1|delete