Why do Custom command not stay local to search heads?

[oliverja]

(Search head cluster/indexer cluster environment)

I have written a custom search, using the template provided by Splunk for streaming commands.

In an attempt to force the search to run on the search heads and not on the indexers, I added the @Configuration(local=True) bit to the code.

from splunklib.searchcommands import dispatch, StreamingCommand, Configuration, Option, validators


@Configuration(local=True)
class StreamingCSC(StreamingCommand):

I got that change from here:

https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/pythonclassescustom/

but the search still dies.

If i modify my search to put the |sort something | mycustomcommand, the search is forced to run locally and it works fine.

What am I doing wrong in trying to keep this search off the indexers and only on the search head cluster?

[oliverja · Accepted solution]

I was not able to get the (local=True) to work properly, but I fixed the issue by moving the splunklib folder from "lib" to "bin". An alternative would have been to change the distsearch.conf to add my lib folder to the whitelist, but this impacts all apps, and I did not want to mess with other configs. This change keeps the change local to the app I made.