Splunk Search

Preview Mode not working in Custom Command

ivrift
Engager

Hello,

why do custom commands not work in Preview mode?

Here is the INFO log I've recieved in my search.log:

04-13-2020 15:51:59.803 INFO  ChunkedExternProcessor - Exiting custom search command after getinfo since we are in preview mode:mystream

jkat54
SplunkTrust
SplunkTrust

Simple answer, they do work in preview mode if you write your code to support it.

0 Karma

frechetta93
Explorer

Can you elaborate on that @jkat54?

0 Karma

jkat54
SplunkTrust
SplunkTrust
0 Karma

jkat54
SplunkTrust
SplunkTrust
run_in_preview = <boolean>
* Whether or not to run this command if generating results just for preview
  rather than for final output.
* Default: true
0 Karma

supersleepwalke
Communicator

Can you please elaborate? I'm having the same problem, but this isn't enough to help me fix my problem. I'm finding the documentation on writing custom commands pretty sparse.

grittonc
Contributor

Can you elaborate on that?

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise

The Trust Gap: Why a data foundation is fundamental to an  Agentic Enterprise.   Agentic AI is transforming ...

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...