Create and apply a custom command function for the Edge Processor solution

Create custom command functions in Search Processing Language Version 2 (SPL2) and apply them to new or existing pipelines. Custom command functions are user-defined to reuse common data transformations between multiple pipelines. For example, if you process the same sourcetype in multiple pipelines, use a custom command function to extract fields instead of copying and pasting code between pipelines.

Steps to create and publish a custom command function

To create and publish a custom command function, see the following steps:

  1. In Splunk Enterprise, select the Search & Reporting app.

  2. Navigate to the Modules page, and then select Create module.

  3. Write your custom command function in SPL2. Both the source and the return type have to be dataset. For more information on SPL2, see Quick Reference for SPL2 commands in the SPL2 Search Reference.

    See the following custom command function example in SPL2:
    JAVASCRIPT 
    /**
        * This is a custom command function that takes one argument
        * @param $source
        * @param $arg - description of arg
        */
        function command_function_with_argument($source:dataset, $arg:string):dataset {
        return | from $source
        | eval tag = "Has run command_function_with_argument with ${$arg}";
        }
        export command_function_with_argument

  4. Export your module by adding the line export <name of your function>. As a shortcut, select the three dots (⋮) next to the custom command function's name in the outline, and then select Export. This will add the line for you. See Exporting module items using SPL2 in the SPL2 Search Manual for more information.

  5. Select Save module, and do the following:

    1. Give your module a name.

    2. Change the Namespace from Private to App.

    3. Select Save module and configure permissions.

    4. In the Configure permissions dialog box, make sure that the apps role has at least Execute permission for this module. Additionally, make sure that a role assigned to the users that you want to share this custom command function with also has at least Execute permission.

    5. Select Save.

Apply a custom command function to a pipeline

You can discover custom command functions and apply them to your pipelines once a custom command function has been published by you or a colleague. You both need to be members of the same shared workspace.

Apply a custom command function to an existing pipeline

You can discover custom command functions and apply them to your pipelines once a custom command function has been published by you or a colleague. You both need to be members of the same shared workspace.

To apply a custom command function to an existing pipeline, see the following steps.

  1. Navigate to the Pipelines page.

  2. Select the Actions icon (Image of the Actions icon) in the row that lists your pipeline, and then select Edit. This will take you to the pipeline editor for that pipeline.

  3. Select the plus icon (This image shows an icon of a plus sign.) in the Actions area of the pipeline builder and select Apply custom command function.

  4. Search for the name of your custom command function, and view its documentation. Specify parameters values for the selected custom command function as necessary.

  5. Select Apply.

Apply a custom command function to a new pipeline

You can use a custom command function in a new pipeline before it has been saved. See the following steps:

  1. Navigate to the Pipelines page, then select New pipeline and then Edge Processor pipeline.

  2. Follow the on-screen instructions until you get to the SPL2 editor. For more information, see the steps in Create pipelines for Edge Processors. manual.

  3. Select the plus icon (This image shows an icon of a plus sign.) in the Actions area of the pipeline builder and select Apply custom command function.

  4. Search for the name of your custom command function, and view its documentation. Specify parameters values for the selected custom command function as necessary.

  5. Select Apply.