Splunk Dev

Custom Search Command (V2/Chunked): Persist script

spunk_enthusias
Path Finder

Hi! Long time listener, first time caller here.

Our custom search command needs some slow initialization, which we would prefer to skip on repeated calls.

Is there a way to keep the process alive after the first invocation and only call dispatch() afterwards?
Something that does what scripttype = persist does for REST endpoints.

My understanding is that the protocol would allow this.

Calling dispatch() in a loop sadly doesn't work - would've been too easy, huh?
(It does work in so far that the command finishes - it's just that the script gets started again the next time)

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...