Custom search command (v2/chunked): Script is called twice

[spunk_enthusias]

I am writing a custom search command that is quite performance sensitive. On every invocation the script is called twice and runs up to the prepare() method, which puts an unnecessary strain on the system.

I could imagine that this is related to the command's general slowness, so the ability to disable it would be nice.

[arkadyz1]

Reviving the thread a year later: I have the same problem, had it back in Splunk 6.6.2 and still seeing it in Splunk 8.2.6 years later. No idea why - but I really needed to work around it.

Here is what I came up with: I open a file, with a name derived from search id, with exclusive access for creation in a special `lock` folder. If it succeeds, I proceed with the rest of the code. If it fails, I realize that it was already "caught" by the previous run of the same command and bail out.

Of course, I need some way of tidying up that `lock` folder, which is something that can be done with a scripted input, and not too frequently - once a day or even once a week should be plenty. In theory, I should be able to remove (unlink) that lock file right from the second instance, but it bit me in the back, so I abandoned the idea. Might want to revisit now, after so many years...

[arkadyz1]

In fact, I have asked that very question in 2017, did not get an answer and created this solution. Here is the link to my post: Solved: Re: Custom search command called multiple times - Splunk Community

There, you can find a more detailed description of my solution.

[spunk_enthusias]

Noah Dietrich, the most official source of information on custom search commands (!) doesn't exactly know why this happens either (13:00).