Splunk Search

Preview Mode not working in Custom Command

ivrift
Engager

Hello,

why do custom commands not work in Preview mode?

Here is the INFO log I've recieved in my search.log:

04-13-2020 15:51:59.803 INFO  ChunkedExternProcessor - Exiting custom search command after getinfo since we are in preview mode:mystream

jkat54
SplunkTrust
SplunkTrust

Simple answer, they do work in preview mode if you write your code to support it.

0 Karma

frechetta93
Explorer

Can you elaborate on that @jkat54?

0 Karma

jkat54
SplunkTrust
SplunkTrust
0 Karma

jkat54
SplunkTrust
SplunkTrust
run_in_preview = <boolean>
* Whether or not to run this command if generating results just for preview
  rather than for final output.
* Default: true
0 Karma

supersleepwalke
Communicator

Can you please elaborate? I'm having the same problem, but this isn't enough to help me fix my problem. I'm finding the documentation on writing custom commands pretty sparse.

grittonc
Contributor

Can you elaborate on that?

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...