Wanted to understand the need for the getidxwhitelist custom command, from what I have looked it is counting the number of whitelist indexes and lists the indexes itself for filtering the base querie...
Quick question regarding version 2.2 of DECRYPT https://splunkbase.splunk.com/app/2655/ Why does the commands.conf have a local=true under the decrypt command? It did not have this previously and i...
I have created a custom search command and placed my py file in search/bin and then I have created search/local/commands.conf file and added
[data]
filename = data.py
streaming = false
c...
I am in /opt/apps/splunk/etc/apps/search/default
when I edit commands.conf it says
DO NOT EDIT THIS FILE!
Please make all changes to files in $SPLUNK_HOME/etc/system/local
does that m...
I've created a script that, when called from the search bar using:
|script foo.py | outputtext
it outputs a table containing one unnamed column containing the script output and an empty _raw...
When using splunk.Intersplunk.outputResults for even 1 record as a streaming command, I get an extra header with a improperly casted time field that ends up making the search compain about fields com...
...pp_name> is search because its a search command. So I created
$SPLUNK_HOME/etc/app/<app_name>/local/commands.conf
and put in a single santza for my command. Saved it, restarted splunk and t...
I'd like to push an app that overwrites which script sendemail uses. For instance I pushed:
email_app
bin/sendemail2.py
local/commands.conf
filename = sendemail2.py
metadata/d...
...xternal search command 'disabler' does not exist in commands.conf.
I have placed the commands.conf file in both the default and local folders and have restarted Splunk, but the results are always t...