Splunk Search

Which commands.conf should I add my custom search command to?

tristanmatthews
Path Finder

Hi,

Last week I defined a custom search command, and after reading the documentation I decided that I should reference it in:

$SPLUNK_HOME/etc/app/<app_name>/local

where my <app_name> is search because its a search command. So I created

$SPLUNK_HOME/etc/app/<app_name>/local/commands.conf

and put in a single santza for my command. Saved it, restarted splunk and tested it. After debugging worked great, so did all the normal search commands. Over the thanksgiving weekend my splunk started crashing. I think it unrelated and has todo with some security changes we made to the server, but wanted to double check that I didn't my "guess" about where to put it isn't destroying things. (btw its are still crashing once it remove the new commands.conf and restart so I'm fairly sure its not the problem).

-Tristan

Tags (1)
0 Karma
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

If you want it in the context of your app, then you've put it in the correct spot.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationfiledirectories

One correction though, the path in your question should contain "apps", not "app":

$SPLUNK_HOME/etc/apps/<app_name>/local/commands.conf

View solution in original post

sbrant_splunk
Splunk Employee
Splunk Employee

If you want it in the context of your app, then you've put it in the correct spot.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationfiledirectories

One correction though, the path in your question should contain "apps", not "app":

$SPLUNK_HOME/etc/apps/<app_name>/local/commands.conf

sbrant_splunk
Splunk Employee
Splunk Employee

It doesn't need to be a copy of the default. Only new items or those that you want to override in default should go into local.

0 Karma

tristanmatthews
Path Finder

Your right it should be apps, and is in my install. The documentation:

http://docs.splunk.com/Documentation/Splunk/5.0.4/Search/AddthecustomcommandtoSplunk

which I copied the string from however lists the path incorrectly as "app".

Just to be painfully clear, my commands.conf should only have the single stanza for my command, it isn't a copy of the default with my command added?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...