Splunk Search

Generating custom command not streaming output

jakubzak
Explorer

I have created following custom command:

@Configuration(streaming=True)
class GenerateTextCommand(GeneratingCommand):

  count = Option(require=True, validate=validators.Integer(0))
  text = Option(require=True)

  def generate(self):
    for i in range(1, self.count + 1):
       sleep(5)
       yield {'id': i, '_time': time.time(), '_raw': unicode(i) + '. ' + self.text}

dispatch(GenerateTextCommand, sys.argv, sys.stdin, sys.stdout, __name__)

and I have prepared configuration in commands.conf:

[teststream]
filename = testStream.py
chunked = true

My expectation is that if I execute this command in Search command line in Splunk UI:

| teststream count=4 text="asdf"

It will print out each 5 seconds asdf text 4 times. Instead of it it generates 4 events and prints it after 20 seconds. Timestamps shows that generation time is strictly by "my rules" - new message each 5 seconds.

Is my understanding of "output streaming" from custom command incorrect or am I doing something wrong?

Thanks for help

Jakub

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...