Splunk Dev

splunk.Intersplunk.outputResults sending another header? Or bad commands.conf options?

rshoward
Path Finder

When using splunk.Intersplunk.outputResults for even 1 record as a streaming command, I get an extra header with a improperly casted time field that ends up making the search compain about fields coming back in the wrong time order thus throwing an error.

The external search command 'command' did not return events in descending time order, as expected.

if I turn off streaming, I get:

    _time                    commandfield    logfield
1   4/3/74 10:46:24.314 AM   commandfield    logfield
2   4/8/11 10:00:26.000 PM   5.39677852134   value1
3   4/8/11 10:00:26.000 PM   5.39677852134   value2
4   4/8/11 10:00:12.000 PM   5.1593157535    value3
5   4/8/11 10:00:12.000 PM   5.1593157535    value4
6   4/8/11 9:59:55.000 PM    5.52337405618   value5
7   4/8/11 9:59:55.000 PM    5.53858132907   value6
8   4/8/11 9:59:55.000 PM    5.53426175508   value7

I've tried using outputheader=true and I get zero results

I'm probably doing something dumb, backwards or wrong but I just don't see it yet...

0 Karma
1 Solution

carasso
Splunk Employee
Splunk Employee

That output looks very strange.

I'm unsure about all the settings for your command in command.conf.

I'm also unsure what your command is doing with the _time values -- whether it's casting them to a string, for example.

This would be putting a bandaid on cancer, but you might want to look at the generates_timeorder and overrides_timeorder settings for your command in commands.conf.

View solution in original post

carasso
Splunk Employee
Splunk Employee

That output looks very strange.

I'm unsure about all the settings for your command in command.conf.

I'm also unsure what your command is doing with the _time values -- whether it's casting them to a string, for example.

This would be putting a bandaid on cancer, but you might want to look at the generates_timeorder and overrides_timeorder settings for your command in commands.conf.

rshoward
Path Finder

this was all in my fast and flustered attempt at getting my first streaming command, and first python code (Yes I've been living under a rock, but only renting), to run before the weekend.

I ended up with http://answers.splunk.com/questions/13636/calculate-entropy-just-entropy-not-change-in-entropy-like-...

I came to the conclusion that I might have been using the functions completely backwards. (bulk for streaming etc)

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...