Splunk Dev

Why do Custom command not stay local to search heads?

oliverja
Path Finder
 

(Search head cluster/indexer cluster environment)

I have written a custom search, using the template provided by Splunk for streaming commands.

In an attempt to force the search to run on the search heads and not on the indexers, I added the @Configuration(local=True) bit to the code.

 

 

 

from splunklib.searchcommands import dispatch, StreamingCommand, Configuration, Option, validators


@Configuration(local=True)
class StreamingCSC(StreamingCommand):

 

 

 

I got that change from here:

https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/pythonclassescustom/

but the search still dies.

oliverja_1-1656582943847.png

If i modify my search to put the |sort something | mycustomcommand, the search is forced to run locally and it works fine.

What am I doing wrong in trying to keep this search off the indexers and only on the search head cluster?

Labels (2)
0 Karma
1 Solution

oliverja
Path Finder

I was not able to get the (local=True) to work properly, but I fixed the issue by moving the splunklib folder from "lib" to "bin". An alternative would have been to change the distsearch.conf to add my lib folder to the whitelist, but this impacts all apps, and I did not want to mess with other configs. This change keeps the change local to the app I made.

View solution in original post

0 Karma

oliverja
Path Finder

I was not able to get the (local=True) to work properly, but I fixed the issue by moving the splunklib folder from "lib" to "bin". An alternative would have been to change the distsearch.conf to add my lib folder to the whitelist, but this impacts all apps, and I did not want to mess with other configs. This change keeps the change local to the app I made.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...