Until now, our commands have returned the original events with modifications to their fields. Commands can also transform data, much like the built-in functions top and stats. Let's write a function to count the words in our events. You can find this example in ImplementingSplunkExtendingExamples/bin/countwords.py:
import splunk.Intersplunk as si import re import operator from collections import defaultdict #create a class that does the actual work class WordCounter: word_counts = defaultdict(int) unique_word_counts = defaultdict(int) rowcount = 0 casesensitive = False mincount = 50 minwordlength = 3 def process_event(self, input): self.rowcount += 1 words_in_event = re.findall('W*([a-zA-Z]+)W*', input) unique_words_in_event ...
