Is there a way to find out how each of the search commands work?

[fengl2]

Is there a way finding how each of the search commands works?
I mean to see the code?

For example, can I know how the convert commands works and edit it for my certain requirement?

[lguinn2 · Accepted solution]

You can see the code for some commands, but not for all.

You can look at the code in $SPLUNK_HOME/etc/apps/search/bin. And yes, you could change the Python code, but your code would get overwritten in the next Splunk update. So create your own app, copy any script you want to modify, and work with your copy of the script.

If you want, you can writea custom search command. I think that writing your own command would be a better solution that editing an existing command - although I would use an existing script as a starting point. Here is a link to the documentation on writing a Custom Search Command

You will probably want to read this documentation carefully so that you can understand how the existing scripts work.

[fengl2]

Many thanks!it's really helpful.