I am trying to implement a custom streaming search-command right now. I would like to use the SCP v2 protocol with the splunklibs python interface. The command itself is running fine but the "remoteSearch" field and the overall performance indicates that it is not distributed to the indexer-cluster but rather executed on the searchhead.
I tried different options for the Configuration Decorator (e.g. distributed=true) but it did not have any effect.
I am inheriting from StreamingCommand and so I am not able to mutate the "type" field in the configuration. The type is said to be "streaming" in the documentation but it turns out to be "stateful" when read out from "self.configuration" (from inside the commands class)
To me this seems to be the cause for my command not being "distributable streaming" but rather "stateful streaming". How can I tackle this to be able to distribute my command to the indexer-cluster for optimal performance?