Splunk Dev

Editing of search results using python and not inline with my search

sarahh
Engager

Hi, is there any way where I can rename a specific value of the search results by coding it in our own custom command python file? Please help. Thanks.

Tags (4)
0 Karma

sarahh
Engager

yes, that's what i mean.

0 Karma

Ayn
Legend

I still don't understand - do you mean that you already wrote a custom command that does some other things and now you want to add this additional functionality to it?

0 Karma

sarahh
Engager

because i wanna it to be tgt with my custom command. so that when i run my custom command, the results will be out immediately.

0 Karma

Ayn
Legend

See below - I still don't understand the requirement that this has to be done in Python. Why?

0 Karma

Ayn
Legend

Why not just do

... | replace plants with somethingelse in category_id

or

... | eval category_id=if(category_id=="plants","somethingelse",category_id)

?

Or if you want to change how the actual raw data is displayed, you could instead do

... | replace "category_id = plants" with "category_id = somethingelse" in _raw

...or the same eval technique as above but with _raw instead.

sarahh
Engager

for example, theres a data in one of the search event containing "category_id = plants" Is there anyway where i can edit/shuffle the word "plants" by coding in my custom command python file? A pity i couldn't upload the picture to have a clearer view. 😞

0 Karma

Ayn
Legend

Tell us more about what you want to achieve, preferably with log samples, and we can probably advise you where to go next. Writing your own custom command is one of many routes to take, and not the easiest one so there may be other alternatives that could work even better.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...