Splunk Dev

Why do Custom command not stay local to search heads?

oliverja
Path Finder
 

(Search head cluster/indexer cluster environment)

I have written a custom search, using the template provided by Splunk for streaming commands.

In an attempt to force the search to run on the search heads and not on the indexers, I added the @Configuration(local=True) bit to the code.

 

 

 

from splunklib.searchcommands import dispatch, StreamingCommand, Configuration, Option, validators


@Configuration(local=True)
class StreamingCSC(StreamingCommand):

 

 

 

I got that change from here:

https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/pythonclassescustom/

but the search still dies.

oliverja_1-1656582943847.png

If i modify my search to put the |sort something | mycustomcommand, the search is forced to run locally and it works fine.

What am I doing wrong in trying to keep this search off the indexers and only on the search head cluster?

Labels (2)
0 Karma
1 Solution

oliverja
Path Finder

I was not able to get the (local=True) to work properly, but I fixed the issue by moving the splunklib folder from "lib" to "bin". An alternative would have been to change the distsearch.conf to add my lib folder to the whitelist, but this impacts all apps, and I did not want to mess with other configs. This change keeps the change local to the app I made.

View solution in original post

0 Karma

oliverja
Path Finder

I was not able to get the (local=True) to work properly, but I fixed the issue by moving the splunklib folder from "lib" to "bin". An alternative would have been to change the distsearch.conf to add my lib folder to the whitelist, but this impacts all apps, and I did not want to mess with other configs. This change keeps the change local to the app I made.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...