I would like to make a streamable custom function, that get some xml message :
index=* parameter1=2 | myCustomFunction
This function should read the content of field1, and for each element write a new line.
Is it possible to make an "mvexpand" in my custom python search function ? Can I add a result event ?
Hi sbsbb,
yes, this is possible within your script. You need to load the following Splunk Python module splunk.Intersplunk
and use splunk.Intersplunk.getOrganizedResults()
to recieve key=value pairs from the previous results.
This means, if your base search returns field1=foo
your script can then use this key field1
and its value of foo
.
As always, docs is a good place to start Custom search commands
hope this helps to get you started ...
cheers, MuS
Hi sbsbb,
yes, this is possible within your script. You need to load the following Splunk Python module splunk.Intersplunk
and use splunk.Intersplunk.getOrganizedResults()
to recieve key=value pairs from the previous results.
This means, if your base search returns field1=foo
your script can then use this key field1
and its value of foo
.
As always, docs is a good place to start Custom search commands
hope this helps to get you started ...
cheers, MuS
I know that...
In fact I was not aware that I can simply just append many row to the results (thats what mvexpand make) :
for result in results:
out_results.append(result)
out_results.append(result)
si.outputResults(out_results)
okay, completely miss understood the question in this case 🙂
Still, if you want to write a custom command that reads something from events ( like mvexpand
does ) your custom command script needs the splunk.Intersplunk module to be loaded.
That doesn't help at all, sorry, I was asking on how to make a mvexpand in my code... not how to retrieve Data...
Let say, I'm reading a line, and I want to duplicate this line x-time, to expand the values from one field (what mvexpand make in the search command, but I need to make it in the script)