How should I configure a custom python generating search command to use the events pipeline?

[cnestrud]

I am trying to create a custom python generating search command which will be used with the events pipeline. It should generate events on the search head and should not distributed to indexers.

I am using splunk-sdk-python version 1.6.2 and Splunk version 6.5.1.

In commands.conf:

[abc]
filename = abc.py
chunked = true

In abc.py:

#!/usr/bin/env python

from __future__ import absolute_import, division, print_function, unicode_literals
from splunklib.searchcommands import dispatch, GeneratingCommand, Configuration, Option, validators
import sys
import time

@Configuration(type = 'eventing')
class AbcCommand(GeneratingCommand):
    [...]
    def generate(self):
        [...]
                yield event
        self.finish()

dispatch(AbcCommand, sys.argv, sys.stdin, sys.stdout, __name__)

From the search log:

02-01-2017 12:26:54.489 INFO  ChunkedExternProcessor - Running process: /opt/splunk/bin/python /opt/splunk/etc/apps/myapp/bin/abc.py
02-01-2017 12:26:54.615 INFO  ChunkedExternProcessor - Custom search command is a generating command.
02-01-2017 12:26:54.615 ERROR ChunkedExternProcessor - Invalid custom search command type: eventing
02-01-2017 12:26:54.716 ERROR ChunkedExternProcessor - Failure reading getinfo chunk

How should I configure this command so that it uses the events pipeline?

[cnestrud · Accepted solution]

I was able to get this to work by changing the decorator to:

@Configuration(type='events')

And also modifying our local copy of the Splunk Python SDK to allow ‘events’ as a valid option:

diff --git a/splunklib/searchcommands/internals.py b/splunklib/searchcommands/internals.py
index be57703..23989ad 100644
--- a/splunklib/searchcommands/internals.py
+++ b/splunklib/searchcommands/internals.py
@@ -326,7 +326,7 @@ class ConfigurationSettingsType(type):
             supporting_protocols=[1, 2]),
         'type': specification(
             type=(bytes, unicode),
-            constraint=lambda value: value in ('eventing', 'reporting', 'streaming'),
+            constraint=lambda value: value in ('eventing', 'reporting', 'streaming', 'events'),
             supporting_protocols=[2])}

[aaraneta_splunk]

@cnestrud - Glad you were able to find the solution. Please don't forget to resolve your post by clicking "Accept" below your answer so that others can easily find it if they are having the same issue. Thanks!