Developing for Splunk Enterprise

What's the advantage of using __GETINFO__ in custom search scripts?

Super Champion

I've written a few custom searches scripts and some of them have used getinfo, and other have not. (Probably based on whichever example I was starting from.)

Can anyone give some insight into what the advantages/disadvantages to using the getinfo feature in custom search scripts? (Possibly some examples where one would be preferable over the other?)

The Custom search commands docs do explain a little bit, but I was hoping for some additional use cases or examples.

Does splunk recommend that newly written scripts use this feature?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Seems mostly not that useful, as you have to provide a commands.conf entry for your script to set supports_getinfo anyway. I guess it's handy if you think you might update the script to change its settings and save yourself updating the conf file, but honestly, it seems like it's easier to just set the values in the commands.conf file.

The biggest advantage is just that you can stop the search early if the arguments to your script aren't good, but while nice, that's not really that major an advantage. There's some unlikely cases where you script might use different settings dynamically, but that seems like a real stretch.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Seems mostly not that useful, as you have to provide a commands.conf entry for your script to set supports_getinfo anyway. I guess it's handy if you think you might update the script to change its settings and save yourself updating the conf file, but honestly, it seems like it's easier to just set the values in the commands.conf file.

The biggest advantage is just that you can stop the search early if the arguments to your script aren't good, but while nice, that's not really that major an advantage. There's some unlikely cases where you script might use different settings dynamically, but that seems like a real stretch.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!