Splunk Search

Preview generating custom command result

electronicsplun
New Member

Hi

I want to add a generating custom command that will query one of our DBs. So I have followed the tutorials and created a class that inherits from GeneratingCommand and implemented the generate method. Problem is that Splunk waits for all the results to return and the query might be slow (4-5 seconds). So following some of the docs it looks like timeline_events_preview is what I need but I still don't get the live update of the events view (Similar to using the builtin search command).

I can't post the original code (for copyright reasons) but I can't make it work even with the next simple example:

@Configuration(streaming=True)
class MyGeneratingCommand(GeneratingCommand):
    def generate(self):
        for i in range(10 ** 6):
            yield {'_time': time.time(), '_raw': 'test {}'.format(i), 'events_no': i}

I added a limits.conf file to $SPLUNK_HOME/etc/apps/myapp/local with:

[search]
timeline_events_preview = true

When I use the custom command Splunk waits for all 1 million results to return before showing some of them in the events view.

0 Karma

electronicsplun
New Member

So my problem was that I used the SCPv1 instead of using SCPv2 that supports the chunked. This property of the SCPv2 should be documented more because I didn't find any explicit and clear description of the differences between v1 and v2.

0 Karma

kcnolan13
Communicator

So you actually solved the problem? I'm trying the same thing using SCPv2 and it still waits for all 1M results before showing them in preview. Same configuration settings and CSC.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...