<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Custom search command for distributed search in Deployment Architecture</title>
    <link>https://community.splunk.com/t5/Deployment-Architecture/Custom-search-command-for-distributed-search/m-p/86260#M3151</link>
    <description>&lt;P&gt;It depends. If you put it into an app directory, it will be replicated to the indexers, where it will be run from the replicated bundle. If it happens to be pure python, and all additional libraries are also replicated in the app, and doesn't reference any absolute paths, but only files and paths etc relative to the app directory, then it will run fine.&lt;/P&gt;</description>
    <pubDate>Wed, 05 Oct 2011 20:04:20 GMT</pubDate>
    <dc:creator>gkanapathy</dc:creator>
    <dc:date>2011-10-05T20:04:20Z</dc:date>
    <item>
      <title>Custom search command for distributed search</title>
      <link>https://community.splunk.com/t5/Deployment-Architecture/Custom-search-command-for-distributed-search/m-p/86258#M3149</link>
      <description>&lt;P&gt;if I write a custom search command, do I have to put the .py script on both the search head and the indexer?&lt;/P&gt;</description>
      <pubDate>Tue, 04 Oct 2011 18:34:04 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Deployment-Architecture/Custom-search-command-for-distributed-search/m-p/86258#M3149</guid>
      <dc:creator>davecroto</dc:creator>
      <dc:date>2011-10-04T18:34:04Z</dc:date>
    </item>
    <item>
      <title>Re: Custom search command for distributed search</title>
      <link>https://community.splunk.com/t5/Deployment-Architecture/Custom-search-command-for-distributed-search/m-p/86259#M3150</link>
      <description>&lt;P&gt;I suppose that you want your command to work in a distributed search environment and be executed on each search peer.&lt;/P&gt;

&lt;P&gt;The answer is that you can keep your search command just on the search-head &lt;STRONG&gt;but&lt;/STRONG&gt; you'll need to set  &lt;CODE&gt;streaming = true&lt;/CODE&gt;  when defining your command in commands.conf. That will ensure that your command is distributed.&lt;/P&gt;

&lt;P&gt;Note that you still need to set  &lt;CODE&gt;streaming = true&lt;/CODE&gt;  even if your command &lt;STRONG&gt;is not&lt;/STRONG&gt; a streaming command but say, an event-generating command.&lt;/P&gt;</description>
      <pubDate>Wed, 05 Oct 2011 06:36:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Deployment-Architecture/Custom-search-command-for-distributed-search/m-p/86259#M3150</guid>
      <dc:creator>hexx</dc:creator>
      <dc:date>2011-10-05T06:36:53Z</dc:date>
    </item>
    <item>
      <title>Re: Custom search command for distributed search</title>
      <link>https://community.splunk.com/t5/Deployment-Architecture/Custom-search-command-for-distributed-search/m-p/86260#M3151</link>
      <description>&lt;P&gt;It depends. If you put it into an app directory, it will be replicated to the indexers, where it will be run from the replicated bundle. If it happens to be pure python, and all additional libraries are also replicated in the app, and doesn't reference any absolute paths, but only files and paths etc relative to the app directory, then it will run fine.&lt;/P&gt;</description>
      <pubDate>Wed, 05 Oct 2011 20:04:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Deployment-Architecture/Custom-search-command-for-distributed-search/m-p/86260#M3151</guid>
      <dc:creator>gkanapathy</dc:creator>
      <dc:date>2011-10-05T20:04:20Z</dc:date>
    </item>
  </channel>
</rss>

