Splunk Dev

Custom search command (v2/chunked): Script is called twice

spunk_enthusias
Path Finder

I am writing a custom search command that is quite performance sensitive. On every invocation the script is called twice and runs up to the prepare() method, which puts an unnecessary strain on the system.

I could imagine that this is related to the command's general slowness, so the ability to disable it would be nice.

0 Karma

arkadyz1
Builder

Reviving the thread a year later: I have the same problem, had it back in Splunk 6.6.2 and still seeing it in Splunk 8.2.6 years later. No idea why - but I really needed to work around it.

Here is what I came up with: I open a file, with a name derived from search id, with exclusive access for creation in a special `lock` folder. If it succeeds, I proceed with the rest of the code. If it fails, I realize that it was already "caught" by the previous run of the same command and bail out.

Of course, I need some way of tidying up that `lock` folder, which is something that can be done with a scripted input, and not too frequently - once a day or even once a week should be plenty. In theory, I should be able to remove (unlink) that lock file right from the second instance, but it bit me in the back, so I abandoned the idea. Might want to revisit now, after so many years...

0 Karma

arkadyz1
Builder

In fact, I have asked that very question in 2017, did not get an answer and created this solution. Here is the link to my post: Solved: Re: Custom search command called multiple times - Splunk Community

There, you can find a more detailed description of my solution.

0 Karma

spunk_enthusias
Path Finder

Noah Dietrich, the most official source of information on custom search commands (!) doesn't exactly know why this happens either (13:00).

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...