Splunk Search

where is the custom command documentation?

MonkeyK
Builder

Lots of custom commands come with Splunk. 31 in the search app alone.

I often see all of those commands and wonder if there is anything that I could be using. Since I am not an admin on the system, I can't just look at the code to find out.

Is there a place that documents what these commands do and what sort of arguments they expect?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

All of the commands shipped with the Search & Reporting app are documented in the Search Reference Manual (https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/WhatsInThisManual).

Where are you getting the count of custom commands?

---
If this reply helps you, Karma would be appreciated.

MonkeyK
Builder

"Settings|Advanced Search"
"Search Commands"
lists the number of commands that are showing.

some of these are clearly common search commands (head, diff). Others I see no documentation on how to use.
For example:
https://docs.splunk.com/Special:SplunkSearch/docs?q=arulespy
https://docs.splunk.com/Special:SplunkSearch/docs?q=createrss
https://docs.splunk.com/Special:SplunkSearch/docs?q=mocknodegraph

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't recognize any of those commands. I suspect they either came with an app or were produced locally. In the case of the former, consult the app docs or the developer; for the latter case, check with the owner.

---
If this reply helps you, Karma would be appreciated.
0 Karma

MonkeyK
Builder

Well. In the custom commands listing that I described how to find, these commands are listed as part of the search app with an owner of "no owner"

I consulted the app documentation as shown by the links above.

I guess that's why I asked the question that I did.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

That a command is found in the Search app does not necessarily mean it came with that app. It's easy to add commands and other knowledge objects to the standard apps.

Have you tried looking in the command's script file to see if there are comments or if you can see what the code does?

---
If this reply helps you, Karma would be appreciated.
0 Karma

MonkeyK
Builder

Where in the UI do I find the command's script file? Where do I see the command ownership info?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...