Search Manual

Custom search command example

This topic applies to only the Intersplunk.py file and the Version 1 protocol.

For a Version 2 protocol example, see How to create custom search commands using Splunk SDK for Python on dev.splunk.com. There are several examples on that page:

• Starter example
• Basic example
• Shape example

Additionally there are other examples for the Splunk SDK for Python.

This following is an example of a custom search command called shape. The shape command categorizes events based on the event line count (tall or short) and line length (thin, wide, and very_wide) and whether or not the lines are indented.

Add the Python script

Add this script, shape.py, to an appropriate apps directory, $SPLUNK_HOME/etc/apps/<app_name>/bin/ :

  import splunk.Intersplunk 

  def getShape(text):
       description = []
       linecount = text.count("\n") + 1
       if linecount > 10:
           description.append("tall")
       elif linecount > 1:
           description.append("short")
       avglinelen = len(text) / linecount
       if avglinelen > 500:
           description.append("very_wide")
       elif avglinelen > 200:
           description.append("wide")
       elif avglinelen < 80:
           description.append("thin")
       if text.find("\n ") >= 0 or text.find("\n\t") >= 0:
           description.append("indented")
       if len(description) == 0:
           return "normal"
       return "_".join(description)            

  # get the previous search results
  results,unused1,unused2 = splunk.Intersplunk.getOrganizedResults()
  # for each results, add a 'shape' attribute, calculated from the raw event text
  for result in results:
       result["shape"] = getShape(result["_raw"])
  # output results
  splunk.Intersplunk.outputResults(results)

Edit the configuration files

Edit the following configuration files in the local directory for the app, for example $SPLUNK_HOME/etc/app/<app_name>/local.

1. In the commands.conf file, add this stanza:
   
   [shape]
   filename = shape.py
2. In the authorize.conf file, add these two stanzas:
   
   [capability::run_script_shape]
   [role_admin]
   run_script_shape= enabled
3. Restart Splunk Enterprise.

Run the command

This example shows how to run the search from the CLI. You can also run the command in Splunk Web.

Show the top shapes for multi-line events:

$ splunk search "linecount>1 | shape | top shape"

The results of the search are returned in a table format.

shape                       count     percent

tall_indented               43        43.000000 
short_indented              29        29.000000
tall_thin_indented          15        15.000000
short_thin_indented         10        10.000000
short_thin                  3         3.000000