Splunk Dev

Editing of search results using python and not inline with my search

sarahh
Engager

Hi, is there any way where I can rename a specific value of the search results by coding it in our own custom command python file? Please help. Thanks.

Tags (4)
0 Karma

sarahh
Engager

yes, that's what i mean.

0 Karma

Ayn
Legend

I still don't understand - do you mean that you already wrote a custom command that does some other things and now you want to add this additional functionality to it?

0 Karma

sarahh
Engager

because i wanna it to be tgt with my custom command. so that when i run my custom command, the results will be out immediately.

0 Karma

Ayn
Legend

See below - I still don't understand the requirement that this has to be done in Python. Why?

0 Karma

Ayn
Legend

Why not just do

... | replace plants with somethingelse in category_id

or

... | eval category_id=if(category_id=="plants","somethingelse",category_id)

?

Or if you want to change how the actual raw data is displayed, you could instead do

... | replace "category_id = plants" with "category_id = somethingelse" in _raw

...or the same eval technique as above but with _raw instead.

sarahh
Engager

for example, theres a data in one of the search event containing "category_id = plants" Is there anyway where i can edit/shuffle the word "plants" by coding in my custom command python file? A pity i couldn't upload the picture to have a clearer view. 😞

0 Karma

Ayn
Legend

Tell us more about what you want to achieve, preferably with log samples, and we can probably advise you where to go next. Writing your own custom command is one of many routes to take, and not the easiest one so there may be other alternatives that could work even better.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...