Splunk Search

How do you run a script on a column search result?

rolivet
New Member

Hi,

I want to run a script on all values in a column like that:

index="myindex" mysearch_filters | table id | script call_script $id

My py script works when I call |script call_script id1 but I want to do it for every values pf id.
I tried a lot of things without success (using foreach, map, ...).
Can someone tell me how to do that ? Or give me some guidelines ?

Thanks.

Rémy

0 Karma

niketn
Legend

@rolivet can you try with a rather expensive map command? Following example will iterate for 10 ids from the table and then run the script for each id:

index="myindex" mysearch_filters 
| table id 
| map search="| script call_script $id$" maxsearches=10
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...