Custom search commands are user-defined Splunk Search Processing Language (SPL) commands that extend SPL to serve your specific needs. Although Splunk Enterprise ships with an extensive set of search commands, it is possible that these existing commands do not meet your exact requirements. Custom search commands enable you to perform additional data analysis in Splunk. You can implement custom search commands by creating Python scripts.
You can create the following types of SPL commands.
Custom search commands process data through an external Python script that runs alongside splunkd at search time.
The following diagram illustrates how search results exit and then re-enter the search pipeline for a custom search command.
Throughout the custom search command process, splunkd and the custom search command Python script exchange metadata through a series of getinfo and execute commands.
After all search results have passed through the external search command script, splunkd closes the STDIN pipe to terminate the process.
Use the following workflow to create a custom search command.
The Splunk SDK for Python contains the following tools to help you create a custom search command. You can download the Splunk SDK for Python on GitHub.
The splunklib.searchcommands module of the Splunk SDK for Python includes the classes that you need to create a custom search command. The specific class that you use depends on the type of command that you want to create.
For more information about how to use these classes, see Python classes for custom search commands.
For details about the splunklib.searchcommands module in the SDK, see splunklib.searchcommands on GitHub.
The examples/searchcommands_app directory of the Splunk SDK for Python contains a sample app with examples for each type of custom search command.
For more information about these examples, see Custom search command examples.
The Splunk SDK for Python includes templates to help you get started writing your custom search command script. The template that you use depends on the type of command that you want to create.
The following templates are located in the examples/searchcommands_template/bin directory of the SDK.
To download the templates from the SDK, see examples/searchcommands_template/bin on GitHub.