Splunk Dev

Why do Custom command not stay local to search heads?

oliverja
Path Finder
 

(Search head cluster/indexer cluster environment)

I have written a custom search, using the template provided by Splunk for streaming commands.

In an attempt to force the search to run on the search heads and not on the indexers, I added the @Configuration(local=True) bit to the code.

 

 

 

from splunklib.searchcommands import dispatch, StreamingCommand, Configuration, Option, validators


@Configuration(local=True)
class StreamingCSC(StreamingCommand):

 

 

 

I got that change from here:

https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/pythonclassescustom/

but the search still dies.

oliverja_1-1656582943847.png

If i modify my search to put the |sort something | mycustomcommand, the search is forced to run locally and it works fine.

What am I doing wrong in trying to keep this search off the indexers and only on the search head cluster?

Labels (2)
0 Karma
1 Solution

oliverja
Path Finder

I was not able to get the (local=True) to work properly, but I fixed the issue by moving the splunklib folder from "lib" to "bin". An alternative would have been to change the distsearch.conf to add my lib folder to the whitelist, but this impacts all apps, and I did not want to mess with other configs. This change keeps the change local to the app I made.

View solution in original post

0 Karma

oliverja
Path Finder

I was not able to get the (local=True) to work properly, but I fixed the issue by moving the splunklib folder from "lib" to "bin". An alternative would have been to change the distsearch.conf to add my lib folder to the whitelist, but this impacts all apps, and I did not want to mess with other configs. This change keeps the change local to the app I made.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...