Deployment Architecture

CLI command completion broken

Sivrat
Path Finder

Since I realized it existed, I've setup my environment to source the $SPLUNK_HOME/share/splunk/cli-command-completion.sh script to allow tab completion of Splunk commands.

Recently, we upgraded to 8.2.2 after previously being on 8.0.3. After the upgrade, the sourcing of the file no longer works, giving the following 2 stderr messages:
cli-command-completion.sh: line 83: verb_to_objects: bad array subscript
cli-command-completion.sh: line 85: verb_to_objects[$verb]: bad array subscript

It looks like the script was originally a Splunk Answers post by a Splunk Dev that was later included in the Splunk distribution, and has not changed since then:
https://community.splunk.com/t5/Deployment-Architecture/CLI-command-completion-Yes-and-here-s-how-Fo...

However it looks like @V_at_Splunk is no longer active on the community and likely no longer at Splunk, their last post being in 2014.

Is anyone still using this script? Has anyone run into these issues and determined their cause? I suspect something the script references changed, but I'm unsure what was changed.

This was such a nice QoL thing to have it'd be a shame if I had to let it die.

Labels (2)
0 Karma

janderson42
Loves-to-Learn Everything

Been working with Support and this is what has worked.

Verify correct permissions:

chmod 444 $Splunk_home/share/splunk/cli-command-completion.sh
$Splunk_home/bin/setSplunkEnv
$Splunk_home/etc/system/static/splunkrc_cmds.xml

Then open

"$SPLUNK_HOME/etc/system/static/splunkrc_cmds.xml",
Then go to the line 6232 and add merge-buckets for "cmd name"

6232 <cmd name="merge-buckets">

Save the change
$SPLUNK_HOME/bin source ./setSplunkEnv and verify it works.

This got tab completion working again. Hope this helps!

0 Karma

Sivrat
Path Finder

Figured out where things are breaking through some lab testing.

The "merge-buckets" command was added in 8.2.0. In the section of the splunkrc_cmds.xml for it (lines 6215-6259 as of v8.2.2.1), it has an empty name for a cmd tag in line 6232, just has '<cmd name="">

This causes cli-command-completion.sh to fail when it tries to pass it as a command verb array. I added a test to skip null verbs as a workaround to the script, but will open a case to report this as a bug when I can.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

IMO, if it's part of the distribution then it should be supported by Splunk.  Consider contacting Splunk Support for help.

---
If this reply helps you, Karma would be appreciated.

Sivrat
Path Finder

We'll try to do that, once we figure out who in the company has access to the entitlements.

Hopefully it's supported or is getting similar functionality built into the binary, cause being able to tab complete or double tab to get list of subcommands is really nice. 

I'm honestly surprised how little mention I've seen of it, given how handy it is. 

0 Karma

ivohechmann
Explorer

Hi Sivrat, same here after upgrade, do you have any feedback from splunk? Otherwise I'll open a case (too)...

Regards,

ivo 

0 Karma

ivohechmann
Explorer

Got response from splunk, problem is known and will be fixed. meanwhile, entering anything for the empty name value is a workaround.

thank you very much

ivo 

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...