Transforming data

Until now, our commands have returned the original events with modifications to their fields. Commands can also transform data, much like the built-in functions top and stats. Let's write a function to count the words in our events. You can find this example in ImplementingSplunkExtendingExamples/bin/

import splunk.Intersplunk as si import re import operator from collections import defaultdict #create a class that does the actual work class WordCounter: word_counts = defaultdict(int) unique_word_counts = defaultdict(int) rowcount = 0 casesensitive = False mincount = 50 minwordlength = 3 def process_event(self, input): self.rowcount += 1 words_in_event = re.findall('W*([a-zA-Z]+)W*', input) unique_words_in_event ...

Get Implementing Splunk 7 - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.