App: Intersplunk for Perl
Categories:
Description
A perl version of the python Intersplunk module that ships with Splunk.
There are two modules of use:
- Intersplunk::getOrganizedResults reads from stdin and turns the csv into an array of hashes. There is one entry in the array per event, and each entry is a pointer to a hash of the events key/value pairs.
- Intersplunk::outputResults takes a pointer to an array of hashes (such as the one generated by getOrganizedResults) as spits it back to STDOUT as a CSV.
NB: Make sure that you add perl to your path or edit the first line of the script to reflect the proper path.
In your perl search processors, you would use it as follows:
#!/path/to/perl
use intersplunk.pl;
$my_results = Intersplunk::getOrganizedResults();
@results = @{$my_results};
#print the "_raw" field for each event
foreach (@results) {
print $_->{‘”_raw”’};
}
#now pretend you’ve made some changes to the results in the @results and want to send the results back to Splunk
$my_pointer = \@results;
$my_return = Intersplunk::outputResults($my_pointer);If you have problems with this code, please send details of the problem as well as some sample data to reproduce the problem to my username at splunk dot com.
Your Rating
(0 votes)
Login to rate this app