Splunk Search

Why custom search command not working without being prefixed by dedup

Cristian
Observer

Hi,

I created a custom StreamingCommand which makes REST API calls to get user details, based on a userid.

If command is executed as below, it is working as expected

 

index="<hidden_index>" <hidden_filters> | dedup jobFields.user | getuserdetails fields="Division,FullName" userid=jobFields.user 

 

 If I remove the "dedup ..." then the command crashes:

 

index="<hidden_index>" <hidden_filters> | getuserdetails fields="Division,FullName" userid=jobFields.user 

Error: 
[hidden_index_server]Streamed search execute failed because: Error in 'getuserdetails' command: External search command exited unexpectedly with non-zero error code 1..

 

 

The stream method code is below:

 

def stream(self, records):
        for record in records:
            try:
                result = self.getUserDetails(record[self.userid])
                self.log(topic='STREAM', value=result)
                for field in self.fields:
                    if field in result:
                        record[field] = result[field]
                yield record
            except (Exception) as e:
                template = "An exception of type {0} occurred. Arguments:\n{1!r}"
                message = template.format(type(e).__name__, e.args)
                self.log(topic='ERROR', value=message)
        try:
            #update cache details for later use
            self.cachedDetails.updateCache()
        except (Exception) as e:
                template = "An exception of type {0} occurred. Arguments:\n{1!r}"
                message = template.format(type(e).__name__, e.args)
                self.log(topic='ERROR', value=message)

 

 

 

The only reason I needed dedup was because I wanted to save the API calls but now I have a cache and I do not need to do this anymore.

Somehow the error seem to come from the indexers. We have 12 indexers and I get 12 error, 1 for each indexer.

I tried with "localop" but while the errors disappeared,  this is too slow to even consider having it in production.

Any suggestion?

 

Thanks,

Cristian

Tags (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...