-
Notifications
You must be signed in to change notification settings - Fork 27
feat: add custom search command support #1672
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Closed
hetangmodi-crest
wants to merge
7
commits into
feat/split-custom-search-command
from
feat/implementation-custom-search-command
Closed
Changes from all commits
Commits
Show all changes
7 commits
Select commit
Hold shift + click to select a range
3e1dbb4
docs: documentation for custom search command
hetangmodi-crest 68f0319
feat: provide support for custom search command
hetangmodi-crest af15e1b
fix: updated handling of requiredSearchAssistant
hetangmodi-crest b15c43a
chore: Merge branch 'develop' into feat/implementation-custom-search-…
hetangmodi-crest 564a753
refactor: moved argument logic from template files to source code
hetangmodi-crest 0848c84
refactor: renamed reporting and eventing command
hetangmodi-crest bdd58e4
refactor: removed PyGenerator class
hetangmodi-crest File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,224 @@ | ||
# Custom Search Command | ||
|
||
Custom search commands are user-defined [SPL](https://docs.splunk.com/Splexicon:SPL) (Splunk Search Processing Language) commands that enable users to add custom functionality to their Splunk searches. | ||
There are 4 types of Custom search commands that are: | ||
|
||
- Generating | ||
- Streaming | ||
- Transforming | ||
- Dataset processing | ||
|
||
> Note: Reporting commands are being referred as Transforming commands [reference](https://docs.splunk.com/Splexicon:Transformingcommand). | ||
|
||
> Note: Eventing commands are being referred as Dataset processing commands [reference](https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/). | ||
|
||
## Generation of custom search command | ||
|
||
A new tag has been introduced in globalConfig (same indent level as of `meta` tag) named `customSearchCommand` where you need to define the configuration for the custom search command. | ||
|
||
### Minimal definition | ||
|
||
```json | ||
"customSearchCommand": [ | ||
{ | ||
"commandName": "mycommandname", | ||
"fileName": "mycommandlogic.py", | ||
"commandType": "generating", | ||
"arguments": [ | ||
{ | ||
"name": "argument_name", | ||
"validate": { | ||
"type": "Fieldname" | ||
}, | ||
"required": true | ||
}, | ||
{ | ||
"name": "argument_two" | ||
} | ||
] | ||
} | ||
] | ||
``` | ||
|
||
This configuration will generate a template Python file named `mycommandname.py`, which imports logic from the `mycommandlogic.py` file and automatically updates the `commands.conf` file as shown below: | ||
|
||
``` | ||
[mycommandname] | ||
filename = mycommandname.py | ||
chunked = true | ||
python.version = python3 | ||
``` | ||
|
||
**NOTE:** | ||
If the file specified in the `fileName` field does not exist in the `<YOUR_ADDON/bin>` directory, the build will fail. | ||
|
||
### Attributes for `customSearchCommand` tag | ||
|
||
| Property | Type | Description | | ||
| ------------------------ | ------ | ------------------------------------ | | ||
| commandName<span class="required-asterisk">\*</span> | string | Name of the custom search command | | ||
| fileName<span class="required-asterisk">\*</span> | string | Name of the Python file which contains logic of custom search command | | ||
| commandType<span class="required-asterisk">\*</span> | string | Specify type of custom search command. Four types of commands are allowed, `streaming`,`generating`,`transforming` and `dataset processing`. | | ||
| arguments<span class="required-asterisk">\*</span> | object | Arguments which can be passed to custom search command. | | ||
| requiredSearchAssistant | boolean | Specifies whether search assistance is required for the custom search command. Default: false. | | ||
| usage | string | Defines the usage of custom search command. It can be one of `public`, `private` and `deprecated`. | | ||
| description | string | Provide description of the custom search command. | | ||
| syntax | string | Provide syntax for custom search command | | ||
|
||
To generate a custom search command, the following attributes must be defined in globalConfig: `commandName`, `commandType`, `fileName`, and `arguments`. Based on the provided commandType, UCC will generate a template Python file and integrate the user-defined logic into it. | ||
|
||
If `requiredSearchAssistant` is set to True, the `syntax`, `description`, and `usage` attributes are mandatory, as they are essential for generating `searchbnf.conf` file. | ||
|
||
**NOTE:** | ||
The user-defined Python file must include specific functions based on the command type: | ||
|
||
- For `Generating` command, the Python file must include a `generate` function. | ||
- For `Streaming` command, the Python file must include a `stream` function. | ||
- For `Dataset processing` command, the Python file must include a `transform` function. | ||
- For `Transforming` command, the Python file must include a `reduce` function, and optionally a `map` function if a streaming pre-operation is required. | ||
|
||
## Arguments | ||
|
||
| Property | Type | Description | | ||
| --------------------------------------------------------------------- | ------ | ------------------------------------------------------- | | ||
| name<span class="required-asterisk">\*</span> | string | Name of the argument | | ||
| defaultValue | string/number | Default value of the argument. | | ||
| required | string | Specify if the argument is required or not. | | ||
| validate | object | Specify validation for the argument. It can be any of `Integer`, `Float`, `Boolean`, `RegularExpression` or `FieldName`. | | ||
|
||
UCC currently supports five types of validations provided by `splunklib` library: | ||
|
||
- IntegerValidator | ||
+ you can optionally define `minimum` and `maximum` properties. | ||
- FloatValidator | ||
+ you can optionally define `minimum` and `maximum` properties. | ||
- BooleanValidator | ||
+ no additional properties required. | ||
- RegularExpressionValidator | ||
+ no additional properties required. | ||
- FieldnameValidator | ||
+ no additional properties required. | ||
|
||
For more information, refer [splunklib API docs](https://splunk-python-sdk.readthedocs.io/en/latest/searchcommands.html) | ||
|
||
For example: | ||
|
||
```json | ||
"arguments": [ | ||
{ | ||
"name": "count", | ||
"required": true, | ||
"validate": { | ||
"type": "Integer", | ||
"minimum": 1, | ||
"maximum": 10 | ||
}, | ||
"default": 5 | ||
}, | ||
{ | ||
"name": "test", | ||
"required": true, | ||
"validate": { | ||
"type": "Fieldname" | ||
} | ||
}, | ||
{ | ||
"name": "percent", | ||
"validate": { | ||
"type": "Float", | ||
"minimum": "85.5" | ||
} | ||
|
||
} | ||
] | ||
|
||
``` | ||
|
||
## Example | ||
|
||
``` json | ||
{ | ||
"meta": {...} | ||
"customSearchCommand": [ | ||
{ | ||
"commandName": "generatetextcommand", | ||
"fileName": "generatetext.py", | ||
"commandType": "generating", | ||
"requiredSearchAssistant": true, | ||
"description": " This command generates COUNT occurrences of a TEXT string.", | ||
"syntax": "generatetextcommand count=<event_count> text=<string>", | ||
"usage": "public", | ||
"arguments": [ | ||
{ | ||
"name": "count", | ||
"required": true, | ||
"validate": { | ||
"type": "Integer", | ||
"minimum": 5, | ||
"maximum": 10 | ||
} | ||
}, | ||
{ | ||
"name": "text", | ||
"required": true | ||
} | ||
] | ||
}, | ||
], | ||
"pages": {...} | ||
} | ||
``` | ||
|
||
Generated python file named `generatetextcommand.py`: | ||
|
||
``` python | ||
mport sys | ||
import import_declare_test | ||
|
||
from splunklib.searchcommands import \ | ||
dispatch, GeneratingCommand, Configuration, Option, validators | ||
from generatetext import generate | ||
|
||
@Configuration() | ||
class GeneratetextcommandCommand(GeneratingCommand): | ||
""" | ||
|
||
##Syntax | ||
generatetextcommand count=<event_count> text=<string> | ||
|
||
##Description | ||
This command generates COUNT occurrences of a TEXT string. | ||
|
||
""" | ||
count = Option(name='count', require=True, validate=validators.Integer(minimum=5, maximum=10)) | ||
text = Option(name='text', require=True) | ||
|
||
def generate(self): | ||
return generate(self) | ||
|
||
dispatch(GeneratetextcommandCommand, sys.argv, sys.stdin, sys.stdout, __name__) | ||
``` | ||
|
||
Generated stanza in `commands.conf` file | ||
|
||
``` | ||
[generatetextcommand] | ||
filename = generatetextcommand.py | ||
chunked = true | ||
python.version = python3 | ||
``` | ||
|
||
Generated stanza in `searchbnf.conf` file | ||
|
||
``` | ||
[generatetextcommand] | ||
syntax = generatetextcommand count=<event_count> text=<string> | ||
description = This command generates COUNT occurrences of a TEXT string. | ||
usage = public | ||
``` | ||
|
||
### Output | ||
|
||
This is how generatetextcommand search result looks like: | ||
|
||
 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There is something about the files that are generated but what about adding just a few words what the command usage looks like from the user perspective?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Okay, will update the last given example and add a screenshot of the search query.