topic Re: splunk.Intersplunk.outputResults sending another header? Or bad commands.conf options? in Splunk Dev

splunk.Intersplunk.outputResults sending another header? Or bad commands.conf options?

rshoward — Sat, 09 Apr 2011 05:14:52 GMT

When using splunk.Intersplunk.outputResults for even 1 record as a streaming command, I get an extra header with a improperly casted time field that ends up making the search compain about fields coming back in the wrong time order thus throwing an error.

The external search command 'command' did not return events in descending time order, as expected.

if I turn off streaming, I get:

    _time                    commandfield    logfield
1   4/3/74 10:46:24.314 AM   commandfield    logfield
2   4/8/11 10:00:26.000 PM   5.39677852134   value1
3   4/8/11 10:00:26.000 PM   5.39677852134   value2
4   4/8/11 10:00:12.000 PM   5.1593157535    value3
5   4/8/11 10:00:12.000 PM   5.1593157535    value4
6   4/8/11 9:59:55.000 PM    5.52337405618   value5
7   4/8/11 9:59:55.000 PM    5.53858132907   value6
8   4/8/11 9:59:55.000 PM    5.53426175508   value7

I've tried using outputheader=true and I get zero results

I'm probably doing something dumb, backwards or wrong but I just don't see it yet...

Re: splunk.Intersplunk.outputResults sending another header? Or bad commands.conf options?

carasso — Thu, 14 Apr 2011 11:04:53 GMT

That output looks very strange.

I'm unsure about all the settings for your command in command.conf.

I'm also unsure what your command is doing with the _time values -- whether it's casting them to a string, for example.

This would be putting a bandaid on cancer, but you might want to look at the generates_timeorder and overrides_timeorder settings for your command in commands.conf.

Re: splunk.Intersplunk.outputResults sending another header? Or bad commands.conf options?

rshoward — Thu, 14 Apr 2011 23:24:44 GMT

this was all in my fast and flustered attempt at getting my first streaming command, and first python code (Yes I've been living under a rock, but only renting), to run before the weekend.

I ended up with http://answers.splunk.com/questions/13636/calculate-entropy-just-entropy-not-change-in-entropy-like-associate/13701#13701

I came to the conclusion that I might have been using the functions completely backwards. (bulk for streaming etc)