Hello, I coded a generating custom command using the SDK. It's working fine but: Q: How to i get the selected time range  (earliest_time, latest_time)  forwarded to the python script ?  ... View more

Hello, According to dev.splunk.com/view/javascript-sdk/SP-CAAAEFA#blockingjob, setting exec_mode to "blocking" will block the javascript execution until the job returns. // Search everything and return the first 100 results var searchQuery = "search * &#124; head 100"; // Set the search parameters var searchParams = { exec_mode: "blocking", earliest_time: "2012-06-20T16:27:43.000-07:00" }; // A blocking search returns the job's SID when the search is done console.log("Wait for the search to finish..."); // Run a blocking search and get back a job service.search( searchQuery, searchParams, function(err, job) { console.log("...done!\n"); // Get the job from the server to display more info job.fetch(function(err){ // Display properties of the job console.log("Search job properties\n---------------------"); console.log("Search job ID: " + job.sid); console.log("The number of events: " + job.properties().eventCount); console.log("The number of results: " + job.properties().resultCount); console.log("Search duration: " + job.properties().runDuration + " seconds"); console.log("This job expires in: " + job.properties().ttl + " seconds"); // Get the results and display them job.results({}, function(err, results) { var fields = results.fields; var rows = results.rows; for(var i = 0; i < rows.length; i++) { var values = rows[i]; console.log("Row " + i + ": "); for(var j = 0; j < values.length; j++) { var field = fields[j]; var value = values[j]; console.log(" " + field + ": " + value); } } }) }); } ); I tried the code sample adding console.log("TEST") after . The "TEST" message shows up between the: console.log("Wait for the search to finish..."); and console.log("...done!\n"); What can i do to really block until the results are available ? ... View more

Hello, I'd like to know why when we initiate a rolling restart of the indexer cluster, we see a lot of bucket fix up tasks (for search and replication factor). It causes a lot of CPU and I/O pressure on the cluster. I understand that fixup is required when a node goes down/up (leaves or join the cluster), but I don't understand why this should append for a simple splunkd restart managed by the master. Regards, ... View more

Hello, Anybody know where I can find the description of all fields in subtask_seconds group? ... View more