topic Re: Preview Mode not working in Custom Command in Splunk Search

Preview Mode not working in Custom Command

ivrift — Mon, 13 Apr 2020 20:29:25 GMT

Hello,

why do custom commands not work in Preview mode?

Here is the INFO log I've recieved in my search.log:

04-13-2020 15:51:59.803 INFO  ChunkedExternProcessor - Exiting custom search command after getinfo since we are in preview mode:mystream

Re: Preview Mode not working in Custom Command

jkat54 — Tue, 14 Apr 2020 03:25:51 GMT

Simple answer, they do work in preview mode if you write your code to support it.

Re: Preview Mode not working in Custom Command

grittonc — Thu, 25 Jun 2020 20:40:39 GMT

Can you elaborate on that?

Re: Preview Mode not working in Custom Command

supersleepwalke — Fri, 28 Aug 2020 19:30:33 GMT

Can you please elaborate? I'm having the same problem, but this isn't enough to help me fix my problem. I'm finding the documentation on writing custom commands pretty sparse.

Re: Preview Mode not working in Custom Command

frechetta93 — Tue, 15 Jun 2021 20:02:13 GMT

Can you elaborate on that @jkat54?

Re: Preview Mode not working in Custom Command

jkat54 — Tue, 15 Jun 2021 22:11:51 GMT

https://docs.splunk.com/Documentation/Splunk/8.2.0/Admin/Commandsconf

Re: Preview Mode not working in Custom Command

jkat54 — Tue, 15 Jun 2021 22:12:50 GMT

run_in_preview = <boolean>
* Whether or not to run this command if generating results just for preview
  rather than for final output.
* Default: true