Splunk Search

Custom Search Command

sarahh
Engager

Hello,

I have some questions on custom search commands. I've copied this Python script named log.py and placed it in $splunk_home\etc\apps\<app_name>\bin\, and i've added 2 stanza to $splunk_home/etc/local and named it as authorize.conf & commands.conf and restarted Splunk.

However when i try to pipe it ( | log ) to the custom command, they said 'Unknown search command'winad''

What can i do so that it will print out what I've written in the Python script

Tags (3)
0 Karma

dmr195
Communicator

You need to add the section for your custom search command to commands.conf in your app's config directory, not Splunk's config directory.

So try moving what you put into $SPLUNK_HOME/etc/local/commands.conf into $SPLUNK_HOME/etc/apps/<app_name>/default/commands.conf. Then you'll have to restart Splunk for it to notice that you've changed that file.

Also, by default your custom command will only be usable within the app it lives in. If you want to be able to use it from within another app, for example the search app, you'll have to make it global by editing $SPLUNK_HOME/etc/apps/<app_name>/metadata/local.meta (or by making in global using the "Manager" screens in Splunkweb).

helge
Builder

Thanks. I had the same problem and it turned out I had forgotten to add "export=system" to default.meta in my app.

0 Karma

erritesh17
Path Finder

hey I have some problem .. can you tell me how to resolve this issue . and splunk want what type of python file as a custom search command.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Edit your question to include all the configurations you've added.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...