The Splunk Developer platform allows extending the capabilities of Splunk Enterprise by building your custom solutions. One of the ways to extend Splunk is to implement custom search commands, effectively extending Splunk Search Processing Language (SPL). Custom search commands are programs that allow you to stream or report on data.
In a recent Seattle Splunk User Group meeting, Bernie Macias and Jerome Ibanes of Zillow provided an overview of custom search commands, discussed the anatomy of a command, and provided a deep dive into building and packaging them. They demonstrated real-world usage of custom search commands at Zillow.
You can read Bernie’s indepth post on the Zillow blog: Splunk at Zillow
For additional guidance on custom search commands and related examples, see:
– Building custom search commands in Python
– Building a custom search command for Yelp
– Building the Timewrap custom search command
– Building the Getwatchlist custom search command