Splunk Search

Preview generating custom command result

electronicsplun
New Member

Hi

I want to add a generating custom command that will query one of our DBs. So I have followed the tutorials and created a class that inherits from GeneratingCommand and implemented the generate method. Problem is that Splunk waits for all the results to return and the query might be slow (4-5 seconds). So following some of the docs it looks like timeline_events_preview is what I need but I still don't get the live update of the events view (Similar to using the builtin search command).

I can't post the original code (for copyright reasons) but I can't make it work even with the next simple example:

@Configuration(streaming=True)
class MyGeneratingCommand(GeneratingCommand):
    def generate(self):
        for i in range(10 ** 6):
            yield {'_time': time.time(), '_raw': 'test {}'.format(i), 'events_no': i}

I added a limits.conf file to $SPLUNK_HOME/etc/apps/myapp/local with:

[search]
timeline_events_preview = true

When I use the custom command Splunk waits for all 1 million results to return before showing some of them in the events view.

0 Karma

electronicsplun
New Member

So my problem was that I used the SCPv1 instead of using SCPv2 that supports the chunked. This property of the SCPv2 should be documented more because I didn't find any explicit and clear description of the differences between v1 and v2.

0 Karma

kcnolan13
Communicator

So you actually solved the problem? I'm trying the same thing using SCPv2 and it still waits for all 1M results before showing them in preview. Same configuration settings and CSC.

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...