Deployment Architecture

Custom search command for distributed search

davecroto
Splunk Employee
Splunk Employee

if I write a custom search command, do I have to put the .py script on both the search head and the indexer?

gkanapathy
Splunk Employee
Splunk Employee

It depends. If you put it into an app directory, it will be replicated to the indexers, where it will be run from the replicated bundle. If it happens to be pure python, and all additional libraries are also replicated in the app, and doesn't reference any absolute paths, but only files and paths etc relative to the app directory, then it will run fine.

hexx
Splunk Employee
Splunk Employee

I suppose that you want your command to work in a distributed search environment and be executed on each search peer.

The answer is that you can keep your search command just on the search-head but you'll need to set streaming = true when defining your command in commands.conf. That will ensure that your command is distributed.

Note that you still need to set streaming = true even if your command is not a streaming command but say, an event-generating command.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...