I am trying helloworld app from BlogProjects/splunk-custom-search-command-python/hello_world at master · CptOfEvilMinions/BlogProjec.... Compressed and Installed it from file (hello_world.spl). Then restarted Splunk...
But when trying "index="zeek" sourcetype="bro:conn:json" | helloworld" getting Unknown search command 'helloworld'.
# ls -l /opt/splunk/etc/apps/hello_world/
total 4
drwxr-xr-x 2 splunk splunk 28 Sep 21 06:44 bin
drwxr-xr-x 2 splunk splunk 43 Sep 21 06:44 default
drwxr-xr-x 7 splunk splunk 140 Sep 21 06:44 lib
drwxr-xr-x 2 splunk splunk 6 Sep 21 06:44 local
drwx------ 2 splunk splunk 24 Sep 21 06:44 metadata
-rw-r--r-- 1 splunk splunk 46 Sep 21 06:44 README.md
# ls -l /opt/splunk/etc/apps/hello_world/bin
total 4
-rwxr-xr-x 1 splunk splunk 491 Sep 21 06:44 hello_world.py
# cat /opt/splunk/etc/apps/hello_world/default/commands.conf
[helloworld]
python.version = python3
chunked = true
