Wanted to understand the need for the getidxwhitelist custom command, from what I have looked it is counting the number of whitelist indexes and lists the indexes itself for filtering the base querie...
Quick question regarding version 2.2 of DECRYPT https://splunkbase.splunk.com/app/2655/ Why does the commands.conf have a local=true under the decrypt command? It did not have this previously and i...
I have created a custom search command and placed my py file in search/bin and then I have created search/local/commands.conf file and added
[data]
filename = data.py
streaming = false
c...
I am in /opt/apps/splunk/etc/apps/search/default
when I edit commands.conf it says
DO NOT EDIT THIS FILE!
Please make all changes to files in $SPLUNK_HOME/etc/system/local
does that m...
I've created a script that, when called from the search bar using:
|script foo.py | outputtext
it outputs a table containing one unnamed column containing the script output and an empty _raw...
....53858132907 value6
8 4/8/11 9:59:55.000 PM 5.53426175508 value7
I've tried using outputheader=true and I get zero results
I'm probably doing something dumb, backwards or wrong but I j...
I'd like to push an app that overwrites which script sendemail uses. For instance I pushed:
email_app
bin/sendemail2.py
local/commands.conf
filename = sendemail2.py
metadata/d...
...pp_name> is search because its a search command. So I created
$SPLUNK_HOME/etc/app/<app_name>/local/commands.conf
and put in a single santza for my command. Saved it, restarted splunk and t...