I have a custom streaming command which takes a long time to startup (120 seconds) as it loads a cache. I stream usually about 100'000 events to this command in one invocation. This works fine except since we changed it to use python 3. The same Splunk query which streams about 100'000 events to this custom command results in the command being called several times with junks of 10'000 events which makes it obviously very inefficient. Its a distributed environment with single search head and a 100 node dual site indexer cluster. The search head find normally about 2'000'000 events which are distributed to 20 indexers, resulting in this 100'000 events per call on the indexer. Any idea why this junks are spread over several calls to the custom command? ... View more

I have a user which needs to be able to write one specific lookup table which has to be shared globally. I have to control with the permission settings on the lookup  as I have several users/roles where each role has to grant write access to a different lookup table. What i have observed so far: in order to be able to write a lookup table with | outputlookup xxxx.csv, the user needs the capability output_file. This capability is be default granted trough the predefined user role. With the capability output_file, the permission configured in local.meta is ignored,  outputlookup writes happily any lookup file, regardless of the permission, even files which don't exist.   What i am missing here? ... View more

I am implementing a streaming distributed custom command in python which needs to access the kv store on the search head where the command has been issued. The kv stores are to large to distribute them to the indexers and simple lookups are to slow. To connect to the kv store with a REST call, I am using the to session_key authenticate. :   kwargs={} kwargs["owner"] = "nobody" kwargs["app"] = "search" kwargs["host"] = "<hostname>" self.headers = {'output_mode': 'json', 'count':10000} self.connection client.connect(token=self._metadata.searchinfo.session_key,**kwargs)   from then on I access the kvstore with kvs = self.connection.kvstore[.....] and result= kvs.data.query(........) But the instance of the executed command on an indexer fails with a login failure as it gets  the session_key from the local session on the indexer which is not valid to connect to the search head. Is it possible to execute a part of the command on the search head before it gets distribute and pass its result (the session_key) to all distributed executed instances? ... View more