Splunk Search

Debugging custom search commands

Marinus
Communicator

I've been tinkering with a custom search command that uses win32com.client.
When I try to invoke my search command I get the following error

(-2147352567, 'Exception occurred.', (0, None, None, None, 0, -2147200925), None)

I've tried to call the offending section using the bundled interpreter, and it works just fine.

./splunk cmd python

Any ideas I'm kinda stumped.
I really don't want to have my search command, exec an external interpreter.

== Update ==
I've implemented another version that execs a vbs script to invoke the win32 com component.
It also fails which leads me to believe that splunkd is doing something funny.

1 Solution

Marinus
Communicator

Running splunk under a normal user account solves the problem.
On Windows splunk cmd python doesn't run in the same context as the service.

View solution in original post

0 Karma

Marinus
Communicator

Running splunk under a normal user account solves the problem.
On Windows splunk cmd python doesn't run in the same context as the service.

0 Karma

Drainy
Champion

I would follow http://splunk-base.splunk.com/answers/31262/sysstderr-not-logging-to-splunkd

I have been having issues with trying to find errors with custom commands and the link above has an answer which explains how to add logging information to your script so you can try to track where it is producing errors or how far it is going.

0 Karma

Marinus
Communicator

I am able to trap the error. The issue is what the splunkd process does to the environment that causes the python interpreter to behave differently.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Management Digest – August 2026

MichelleCorpora_1-1788182384472.png Welcome to the August 2026 edition of Data Management Digest! August was a ...

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...