Documentation > Splunk > Search Reference > About custom search commands

Search Reference

 


Welcome
Search Overview
Search Commands
Custom Search Commands

About custom search commands

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Contents

About custom search commands

Splunk provides many search commands — such as [1]], fields, [[transaction] — but even better, it lets you to expand the search language any way you want by writing your own search commands.

To add a custom search command to Splunk, you need to:

1. Add your command to commands.conf.

2. Write the code for your search command.

Add your command to commands.conf

All external search commands are configured in commands.conf. The commands.conf.spec (located in the README directory) contains the full list of configuration options with explanations for each. This topic will only discuss a couple of the options. 

[$STANZA_NAME]
type = <string>
filename = <string>

Each stanza represents a search command. The STANZA_NAME is the name that will be specified in search phrases to invoke the command. Search command names can consist only of alphanumeric (a-z, A-Z, and 0-9) characters. New commands should not have the same name of any existing commands.

Each stanza name is then followed by attribute and value pairs for each command. At a minimum, the filename is required for each stanza.

Use the filename key to specify the name of the script. Splunk expects this script to be in all appropriate $SPLUNK_HOME/etc/apps/<app_name>/bin/, otherwise it looks for this script in $SPLUNK_HOME/etc/searchscripts (which is where most of the scripts that ship with Splunk are stored). In most cases, we recommend placing your script within an application.

Use the type key to specify if the script is Python or Perl. By default, Splunk assumes the script is Python.

Write the code!

Your custom search command can be a Python or a Perl script. However, although Perl scripts are allowed, there is less support for them. Read the following topic, Write a Python search command for more specifics about the types of inputs and arguments your script needs to handle.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.0.5/SearchReference/Aboutcustomsearchcommands"

This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!