What's the advantage of using __GETINFO__ in custom search scripts?

[Lowell]

I've written a few custom searches scripts and some of them have used getinfo, and other have not. (Probably based on whichever example I was starting from.)

Can anyone give some insight into what the advantages/disadvantages to using the getinfo feature in custom search scripts? (Possibly some examples where one would be preferable over the other?)

The Custom search commands docs do explain a little bit, but I was hoping for some additional use cases or examples.

Does splunk recommend that newly written scripts use this feature?

[gkanapathy · Accepted solution]

Seems mostly not that useful, as you have to provide a commands.conf entry for your script to set supports_getinfo anyway. I guess it's handy if you think you might update the script to change its settings and save yourself updating the conf file, but honestly, it seems like it's easier to just set the values in the commands.conf file.

The biggest advantage is just that you can stop the search early if the arguments to your script aren't good, but while nice, that's not really that major an advantage. There's some unlikely cases where you script might use different settings dynamically, but that seems like a real stretch.