I am trying to create a custom python generating search command which will be used with the events pipeline. It should generate events on the search head and should not distributed to indexers.
I am using splunk-sdk-python version 1.6.2 and Splunk version 6.5.1.
In commands.conf:
[abc]
filename = abc.py
chunked = true
In abc.py:
#!/usr/bin/env python
from __future__ import absolute_import, division, print_function, unicode_literals
from splunklib.searchcommands import dispatch, GeneratingCommand, Configuration, Option, validators
import sys
import time
@Configuration(type = 'eventing')
class AbcCommand(GeneratingCommand):
[...]
def generate(self):
[...]
yield event
self.finish()
dispatch(AbcCommand, sys.argv, sys.stdin, sys.stdout, __name__)
From the search log:
02-01-2017 12:26:54.489 INFO ChunkedExternProcessor - Running process: /opt/splunk/bin/python /opt/splunk/etc/apps/myapp/bin/abc.py
02-01-2017 12:26:54.615 INFO ChunkedExternProcessor - Custom search command is a generating command.
02-01-2017 12:26:54.615 ERROR ChunkedExternProcessor - Invalid custom search command type: eventing
02-01-2017 12:26:54.716 ERROR ChunkedExternProcessor - Failure reading getinfo chunk
How should I configure this command so that it uses the events pipeline?
I was able to get this to work by changing the decorator to:
@Configuration(type='events')
And also modifying our local copy of the Splunk Python SDK to allow ‘events’ as a valid option:
diff --git a/splunklib/searchcommands/internals.py b/splunklib/searchcommands/internals.py
index be57703..23989ad 100644
--- a/splunklib/searchcommands/internals.py
+++ b/splunklib/searchcommands/internals.py
@@ -326,7 +326,7 @@ class ConfigurationSettingsType(type):
supporting_protocols=[1, 2]),
'type': specification(
type=(bytes, unicode),
- constraint=lambda value: value in ('eventing', 'reporting', 'streaming'),
+ constraint=lambda value: value in ('eventing', 'reporting', 'streaming', 'events'),
supporting_protocols=[2])}
I was able to get this to work by changing the decorator to:
@Configuration(type='events')
And also modifying our local copy of the Splunk Python SDK to allow ‘events’ as a valid option:
diff --git a/splunklib/searchcommands/internals.py b/splunklib/searchcommands/internals.py
index be57703..23989ad 100644
--- a/splunklib/searchcommands/internals.py
+++ b/splunklib/searchcommands/internals.py
@@ -326,7 +326,7 @@ class ConfigurationSettingsType(type):
supporting_protocols=[1, 2]),
'type': specification(
type=(bytes, unicode),
- constraint=lambda value: value in ('eventing', 'reporting', 'streaming'),
+ constraint=lambda value: value in ('eventing', 'reporting', 'streaming', 'events'),
supporting_protocols=[2])}
@cnestrud - Glad you were able to find the solution. Please don't forget to resolve your post by clicking "Accept" below your answer so that others can easily find it if they are having the same issue. Thanks!