Why do I get error message "Unknown search command" for my custom search command?

[andrewtrobec]

Hello All,

I am using Splunk Enterprise 6.6.3 on Windows 10 and trying to get a custom search to work. I've followed this manual http://docs.splunk.com/Documentation/Splunk/6.6.3/Search/Writeasearchcommand along with various answer threads, but I cannot get it to work. I have a script that will calculate business hours between two timestamps. Splunk setup is as follows:

• Custom python script totalbusinesshours.py is located in $SPLUNK_HOME/etc/apps/<app_name>/bin/

• commands.conf located in $SPLUNK_HOME/etc/apps/<app_name>/local/ and encoded with UTF-8-BOM (like the other conf files) contains the following stanza:

  [totalbusinesshours]
  filename = totalbusinesshours.py

After restarting the server I run the following search:

* | totalbusinesshours StartTime EndTime

Which produces this error:

Search Factory: Unknown search command 'totalbusinesshours'.

I've also tried the following search:

* | script totalbusinesshours StartTime EndTime

but this produces a different error:

Error in 'script' command: The external search command 'totalbusinesshours' does not exist in commands.conf.

According to the documentation everything is set up correctly, but nothing works.

Am I missing something? Maybe some flag somewhere to enable the running of external search commands?

Any help would be greatly appreciated!

Thank you and best regards,

Andrew

[DavidHourani]

Hi andrew,

Assuming your python script works and the splunk user has exec permissions. Did you configure commands.conf properly ? Can you post an extract here ?

Also check if you can see your command in : "Advanced search » Search commands". It could be that the permissions are set to app and you're trying to run it in another app.

Regards,
David

[andrewtrobec]

@DavidHourani
Thanks for replying. The commands.conf file has a single stanza and looks like this:

[totalbusinesshours]
filename = totalbusinesshours.py

It is located in $SPLUNK_HOME/etc/apps/local/ and encoded with UTF-8-BOM (like the other conf files).

When I go to Advanced search » Search commands, I do not see an entry.

[DavidHourani]

Splunk has the read/exec permission on the script ? Sorry for asking obvious questions but it could be the reason

[andrewtrobec]

@DavidHourani
I'm running Splunk 6.6.3 on Windows 10. The splunkd service is running with local system account that has admin rights, and AFAIK it has all permissions.