Integration & Deployment • Room 2

Custom Search Commands

Custom Search Commands extend the SPL language itself. Developers write Python classes that inherit from `StreamingCommand`, `GeneratingCommand`, or `ReportingCommand` to create entirely new SPL operators.

For example, a `| geocode ip_address` custom command could call an external API to enrich events with geolocation data directly inside a search pipeline.

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Drag items to their correct zone (or tap item then tap zone on mobile)

Processes events one at a time, like `eval`

Creates new events from scratch, like `makeresults`

Aggregates all events into a summary, like `stats`

Defines the command name and script path

StreamingCommand

GeneratingCommand

ReportingCommand

commands.conf