Splunk Search

Preview Mode not working in Custom Command

ivrift
Engager

Hello,

why do custom commands not work in Preview mode?

Here is the INFO log I've recieved in my search.log:

04-13-2020 15:51:59.803 INFO  ChunkedExternProcessor - Exiting custom search command after getinfo since we are in preview mode:mystream

jkat54
SplunkTrust
SplunkTrust

Simple answer, they do work in preview mode if you write your code to support it.

0 Karma

frechetta93
Explorer

Can you elaborate on that @jkat54?

0 Karma

jkat54
SplunkTrust
SplunkTrust
0 Karma

jkat54
SplunkTrust
SplunkTrust
run_in_preview = <boolean>
* Whether or not to run this command if generating results just for preview
  rather than for final output.
* Default: true
0 Karma

supersleepwalke
Communicator

Can you please elaborate? I'm having the same problem, but this isn't enough to help me fix my problem. I'm finding the documentation on writing custom commands pretty sparse.

grittonc
Contributor

Can you elaborate on that?

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

New Release of Federated Search: Bringing Splunk Analytics to More of Your Data

Organizations today are generating more data than ever and storing it across cloud object stores, data lakes, ...

Inside Event Intelligence: How ITSI Turns Network Alerts into Actionable Incidents

Tech Talk Inside Event Intelligence: How ITSI Turns Network Alerts into Actionable Incidents   Correlating ...

Observability Simplified: Combining User Experience, Application Performance & ...

  Tech Talk Network to App: Observability Unlocked   Today’s digital environments span applications, ...