splunk-security_content/playbooks/custom_functions/string_split.py

def string_split(input_string=None, delimiter=None, strip_whitespace=None, **kwargs):
    """
    Return a list of the components of input_string when split using the specified delimiter. If strip_whitespace is not specified or is "True", strip all whitespace from the beginning and end of each resulting component.
    
    Args:
        input_string (CEF type: *): The string to split
        delimiter: The delimiter to split by, which defaults to a comma
        strip_whitespace: Either True or False to indicate whether or not to remove whitespace before and after each item. Defaults to True
    
    Returns a JSON-serializable object that implements the configured data paths:
        *.item (CEF type: *): One result for each output item
    """
    ############################ Custom Code Goes Below This Line #################################
    import json
    import phantom.rules as phantom
    
    if not delimiter:
        delimiter = ","
    
    # strip_whitespace defaults to True, but if any value besides "True" is provided, it will be set to False
    if strip_whitespace == "True" or strip_whitespace == True or strip_whitespace == None:
        strip_whitespace = True
    else:
        strip_whitespace = False
    
    output_list = input_string.split(delimiter)
    
    outputs = []
    for item in output_list:
        if strip_whitespace:
            item = item.strip()
        outputs.append({"item": item})

    # Return a JSON-serializable object
    assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
    return outputs