When using splunk.Intersplunk.outputResults for even 1 record as a streaming command, I get an extra header with a improperly casted time field that ends up making the search compain about fields coming back in the wrong time order thus throwing an error.
The external search command 'command' did not return events in descending time order, as expected.
if I turn off streaming, I get:
_time commandfield logfield 1 4/3/74 10:46:24.314 AM commandfield logfield 2 4/8/11 10:00:26.000 PM 5.39677852134 value1 3 4/8/11 10:00:26.000 PM 5.39677852134 value2 4 4/8/11 10:00:12.000 PM 5.1593157535 value3 5 4/8/11 10:00:12.000 PM 5.1593157535 value4 6 4/8/11 9:59:55.000 PM 5.52337405618 value5 7 4/8/11 9:59:55.000 PM 5.53858132907 value6 8 4/8/11 9:59:55.000 PM 5.53426175508 value7
I've tried using outputheader=true and I get zero results
I'm probably doing something dumb, backwards or wrong but I just don't see it yet...
That output looks very strange.
I'm unsure about all the settings for your command in command.conf.
I'm also unsure what your command is doing with the _time values -- whether it's casting them to a string, for example.
This would be putting a bandaid on cancer, but you might want to look at the generates_timeorder and overrides_timeorder settings for your command in commands.conf.
this was all in my fast and flustered attempt at getting my first streaming command, and first python code (Yes I've been living under a rock, but only renting), to run before the weekend.
I came to the conclusion that I might have been using the functions completely backwards. (bulk for streaming etc)