
Custom search command example
This topic applies to only the Intersplunk.py file and the Version 1 protocol.
For a Version 2 protocol example, see How to create custom search commands using Splunk SDK for Python on dev.splunk.com. There are several examples on that page:
Additionally there are other examples for the Splunk SDK for Python.
This following is an example of a custom search command called shape
. The shape
command categorizes events based on the event line count (tall or short) and line length (thin, wide, and very_wide) and whether or not the lines are indented.
Add the Python script
Add this script, shape.py
, to an appropriate apps directory, $SPLUNK_HOME/etc/apps/<app_name>/bin/
:
import splunk.Intersplunk
def getShape(text): description = [] linecount = text.count("\n") + 1 if linecount > 10: description.append("tall") elif linecount > 1: description.append("short") avglinelen = len(text) / linecount if avglinelen > 500: description.append("very_wide") elif avglinelen > 200: description.append("wide") elif avglinelen < 80: description.append("thin") if text.find("\n ") >= 0 or text.find("\n\t") >= 0: description.append("indented") if len(description) == 0: return "normal" return "_".join(description)
# get the previous search results results,unused1,unused2 = splunk.Intersplunk.getOrganizedResults() # for each results, add a 'shape' attribute, calculated from the raw event text for result in results: result["shape"] = getShape(result["_raw"]) # output results splunk.Intersplunk.outputResults(results)
Edit the configuration files
Edit the following configuration files in the local directory for the app, for example $SPLUNK_HOME/etc/app/<app_name>/local
.
- In the
commands.conf
file, add this stanza:[shape]
filename = shape.py - In the
authorize.conf
file, add these two stanzas:[capability::run_script_shape]
[role_admin]
run_script_shape= enabled - Restart Splunk Enterprise.
Run the command
This example shows how to run the search from the CLI. You can also run the command in Splunk Web.
Show the top shapes for multi-line events:
$ splunk search "linecount>1 | shape | top shape"
The results of the search are returned in a table format.
shape count percent tall_indented 43 43.000000 short_indented 29 29.000000 tall_thin_indented 15 15.000000 short_thin_indented 10 10.000000 short_thin 3 3.000000
PREVIOUS Control access to the custom command and script |
NEXT Security responsibilities with custom commands |
This documentation applies to the following versions of Splunk Cloud™: 7.0.0, 6.5.1, 6.5.1612, 6.6.0, 6.6.1, 6.6.3, 6.5.0
Comments
Thanks, we've fixed the typo.
This [capability::run_script_shaoe] should be [capability::run_script_shape]
This page desperately needs a version 2 example.