I have some questions on custom search commands. I've copied this Python script named
log.py and placed it in
$splunk_home\etc\apps\<app_name>\bin\, and i've added 2 stanza to
$splunk_home/etc/local and named it as
commands.conf and restarted Splunk.
However when i try to pipe it (
| log ) to the custom command, they said
'Unknown search command'winad''
What can i do so that it will print out what I've written in the Python script
You need to add the section for your custom search command to commands.conf in your app's config directory, not Splunk's config directory.
So try moving what you put into $SPLUNK_HOME/etc/local/commands.conf into $SPLUNK_HOME/etc/apps/<app_name>/default/commands.conf. Then you'll have to restart Splunk for it to notice that you've changed that file.
Also, by default your custom command will only be usable within the app it lives in. If you want to be able to use it from within another app, for example the search app, you'll have to make it global by editing $SPLUNK_HOME/etc/apps/<app_name>/metadata/local.meta (or by making in global using the "Manager" screens in Splunkweb).