I am trying out custom search command.
I have in commands.conf the below
[createrecord1]
chunked = true
filename = myjava.path
command.arg.1 = -jar
command.arg.2 = splunkcreaterecord1.jar
I would like to know how to pass argument values from search
eg if I type |createrecord1 **100**
it execute " java -jar splunkcreaterecord.jar"
without the parameter
I would like the jar file to be executed as java -jar splunkcreaterecord.jar **100**
Kindly assist
Define it like this:
[createrecord1]
chunked = true
filename = myjava.path
command.arg.1 = jar
Then use it like this:
... | createrecord1 jar "splunkcreaterecord1.jar"
Can you try to pass argument in double quotes ""?
Thanks Gaurav for the reply.
Could you kindly elaborate