Splunk Search

Preview Mode not working in Custom Command

ivrift
Engager

Hello,

why do custom commands not work in Preview mode?

Here is the INFO log I've recieved in my search.log:

04-13-2020 15:51:59.803 INFO  ChunkedExternProcessor - Exiting custom search command after getinfo since we are in preview mode:mystream

jkat54
SplunkTrust
SplunkTrust

Simple answer, they do work in preview mode if you write your code to support it.

0 Karma

frechetta93
Explorer

Can you elaborate on that @jkat54?

0 Karma

jkat54
SplunkTrust
SplunkTrust
0 Karma

jkat54
SplunkTrust
SplunkTrust
run_in_preview = <boolean>
* Whether or not to run this command if generating results just for preview
  rather than for final output.
* Default: true
0 Karma

supersleepwalke
Communicator

Can you please elaborate? I'm having the same problem, but this isn't enough to help me fix my problem. I'm finding the documentation on writing custom commands pretty sparse.

grittonc
Contributor

Can you elaborate on that?

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...