Implementing Splunk 7, Third Edition - Third Edition

Manipulating data

It is useful, at times, to modify the value of a field, particularly _raw. Just for fun, let's reverse the text of each event. We will also support a parameter that specifies whether to reverse the words or the entire value. You can find this example in ImplementingSplunkExtendingExamples/bin/reverseraw.py:

import splunk.Intersplunk as si import re #since we're not writing a proper class, functions need to be #defined first def reverse(s): return s[::-1] #start the actual script results, dummyresults, settings = si.getOrganizedResults() #retrieve any options included with the command keywords, options = si.getKeywordsAndOptions() #get the value of words, defaulting to false words = options.get('words', False) #validate the ...