Developing for Splunk Enterprise

Why is my custom streaming search-command executed on the search head?


I am trying to implement a custom streaming search-command right now. I would like to use the SCP v2 protocol with the splunklibs python interface. The command itself is running fine but the "remoteSearch" field and the overall performance indicates that it is not distributed to the indexer-cluster but rather executed on the searchhead.
I tried different options for the Configuration Decorator (e.g. distributed=true) but it did not have any effect.
I am inheriting from StreamingCommand and so I am not able to mutate the "type" field in the configuration. The type is said to be "streaming" in the documentation but it turns out to be "stateful" when read out from "self.configuration" (from inside the commands class)
To me this seems to be the cause for my command not being "distributable streaming" but rather "stateful streaming". How can I tackle this to be able to distribute my command to the indexer-cluster for optimal performance?


There is parameter called "local = true" in commands.conf file which can be used for determining where to execute the queries with search command.

0 Karma


This parameter is not available when using the SCP v2 the spec states:

If true, the only other commands.conf attributes supported are is_risky, maxwait, maxchunksize, filename, and command.arg..

for the "chunked" option which decides on the protocol version

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!