https://community.splunk.com/t5/Splunk-Search/How-to-get-custom-search-command-to-run-local-on-search-head/m-p/497903#M138717 <P>While not a solution, I've gotten around the problem by putting a sort command in front of my command. The sort can only run on the search head which forces my command to the search head as well.</P> Thu, 30 Jan 2020 14:06:49 GMT scottsavareseat 2020-01-30T14:06:49Z https://community.splunk.com/t5/Splunk-Search/How-to-get-custom-search-command-to-run-local-on-search-head/m-p/497902#M138716 <P>I'm trying to use the python sdk to build a custom search command. In my commands.conf, I have "chunked = true" set. I should therefore be using version 2 of the search command language. In my python script, I have the following lines:</P> <PRE><CODE>from splunklib.searchcommands import dispatch, StreamingCommand, Configuration @Configuration(distributed=False,type='streaming') </CODE></PRE> <P>When I remove the type variable from the configuration decoration, the command tries to execute on all my indexers. However, I want it to run local on the search head for now so I can test it and fix issues without having to deploy it all over the place. When I add the type variable, I get the following error messages. There is a valueerror saying that I can't set the type variable. Is there a way around this problem?</P> <PRE><CODE>01-29-2020 20:07:03.600 INFO ChunkedExternProcessor - Running process: /opt/splunk/bin/python3.7 /opt/splunk/etc/apps/myapp/bin/myapp.py 01-29-2020 20:07:03.710 ERROR ChunkedExternProcessor - stderr: Traceback (most recent call last): 01-29-2020 20:07:03.710 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/myapp/bin/myapp.py", line 9, in &lt;module&gt; 01-29-2020 20:07:03.710 ERROR ChunkedExternProcessor - stderr: class myappCommand(StreamingCommand): 01-29-2020 20:07:03.710 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/myapp/bin/lib/splunklib/searchcommands/decorators.py", line 84, in __call__ 01-29-2020 20:07:03.710 ERROR ChunkedExternProcessor - stderr: ConfigurationSetting.fix_up(o.ConfigurationSettings, self.settings) 01-29-2020 20:07:03.710 ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/myapp/bin/lib/splunklib/searchcommands/decorators.py", line 193, in fix_up 01-29-2020 20:07:03.710 ERROR ChunkedExternProcessor - stderr: raise ValueError('The value of configuration setting {} is fixed'.format(name)) 01-29-2020 20:07:03.710 ERROR ChunkedExternProcessor - stderr: ValueError: The value of configuration setting type is fixed 01-29-2020 20:07:03.720 ERROR ChunkedExternProcessor - EOF while attempting to read transport header 01-29-2020 20:07:03.721 ERROR ChunkedExternProcessor - Error in 'myapp' command: External search command exited unexpectedly with non-zero error code 1. 01-29-2020 20:07:03.721 ERROR SearchPhaseGenerator - Fallback to two phase search failed:Error in 'myapp' command: External search command exited unexpectedly with non-zero error code 1. 01-29-2020 20:07:03.722 ERROR SearchOrchestrator - Error in 'myapp' command: External search command exited unexpectedly with non-zero error code 1. 01-29-2020 20:07:03.722 ERROR SearchStatusEnforcer - sid:1580328423.9 Error in 'myapp' command: External search command exited unexpectedly with non-zero error code 1. 01-29-2020 20:07:03.722 INFO SearchStatusEnforcer - State changed to FAILED due to: Error in 'myapp' command: External search command exited unexpectedly with non-zero error code 1. </CODE></PRE> Wed, 29 Jan 2020 20:15:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-custom-search-command-to-run-local-on-search-head/m-p/497902#M138716 scottsavareseat 2020-01-29T20:15:53Z https://community.splunk.com/t5/Splunk-Search/How-to-get-custom-search-command-to-run-local-on-search-head/m-p/497903#M138717 <P>While not a solution, I've gotten around the problem by putting a sort command in front of my command. The sort can only run on the search head which forces my command to the search head as well.</P> Thu, 30 Jan 2020 14:06:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-custom-search-command-to-run-local-on-search-head/m-p/497903#M138717 scottsavareseat 2020-01-30T14:06:49Z https://community.splunk.com/t5/Splunk-Search/How-to-get-custom-search-command-to-run-local-on-search-head/m-p/497904#M138718 <P>If its just for testing that you can try and put "| localop " prior to the command you want to run specifically on the search head.</P> Fri, 31 Jan 2020 02:30:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-custom-search-command-to-run-local-on-search-head/m-p/497904#M138718 Lucas_K 2020-01-31T02:30:58Z https://community.splunk.com/t5/Splunk-Search/How-to-get-custom-search-command-to-run-local-on-search-head/m-p/507693#M141918 <P>Github shows this fix for distributed flag not working properly:</P><P><A href="https://github.com/splunk/splunk-sdk-python/pull/182/files" target="_blank">https://github.com/splunk/splunk-sdk-python/pull/182/files</A><BR /><BR /></P><P>The fix seems to be in the current splunklib.&nbsp; &nbsp;Still not sure how to properly use the distributed flag since I cannot set type=streaming to force splunklib to respect distributed=true/false</P> Mon, 06 Jul 2020 22:35:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-custom-search-command-to-run-local-on-search-head/m-p/507693#M141918 onthebay 2020-07-06T22:35:13Z