Be advised that the cefout search command and corresponding commands.conf need not be distributed to the indexer tier. The cefout command and corresponding commands.conf should be distributed to the indexer tier automatically via distributed search bundle replication. The more likely issue here is that something with distributed search bundle replication is not behaving properly. We're not 100% certain of the root cause at this juncture, but there is at least one report that setting an explicit whitelist for splunk_app_cef files in distsearch.conf can mitigate the issue: [replicationWhitelist] cef = apps[/\\]splunk_app_cef[/\\]... Update: There's also reports that the error is occurring even when artifacts are properly replicated (and we have a working reproduction of this issue). There is a bug open with Splunk Enterprise pertaining to custom streaming commands not correctly being acquired from the bundle. It would make sense that placing the bin directory and corresponding commands.conf in an app installed directly on the indexer would help mitigate this specific issue. Update: cefout.py refers to other libraries, so best to just include bin dir ... View more