Splunk Search

Preview generating custom command result

electronicsplun
New Member

Hi

I want to add a generating custom command that will query one of our DBs. So I have followed the tutorials and created a class that inherits from GeneratingCommand and implemented the generate method. Problem is that Splunk waits for all the results to return and the query might be slow (4-5 seconds). So following some of the docs it looks like timeline_events_preview is what I need but I still don't get the live update of the events view (Similar to using the builtin search command).

I can't post the original code (for copyright reasons) but I can't make it work even with the next simple example:

@Configuration(streaming=True)
class MyGeneratingCommand(GeneratingCommand):
    def generate(self):
        for i in range(10 ** 6):
            yield {'_time': time.time(), '_raw': 'test {}'.format(i), 'events_no': i}

I added a limits.conf file to $SPLUNK_HOME/etc/apps/myapp/local with:

[search]
timeline_events_preview = true

When I use the custom command Splunk waits for all 1 million results to return before showing some of them in the events view.

0 Karma

electronicsplun
New Member

So my problem was that I used the SCPv1 instead of using SCPv2 that supports the chunked. This property of the SCPv2 should be documented more because I didn't find any explicit and clear description of the differences between v1 and v2.

0 Karma

kcnolan13
Communicator

So you actually solved the problem? I'm trying the same thing using SCPv2 and it still waits for all 1M results before showing them in preview. Same configuration settings and CSC.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...