That's interesting, thanks for the info. Helpful to know it's an issue with Splunk's usage of python internally. I was able to solve it by editing commands.conf to the following: [list_entities] filename = list_entities.py enableheader = true outputheader = true requires_srinfo = true supports_getinfo = true supports_multivalues = true supports_rawargs = true python.version = python3   ... View more

I solved it! The solution reflects SO poorly on Splunk. I ran my command with "--debug" and got this output: Command list_entities appears to be statically configured for search command protocol version 1 and static configuration is unsupported by splunklib.searchcommands. Please ensure that default/commands.conf contains this stanza: [generatetext] filename = generatetext.py enableheader = true outputheader = true requires_srinfo = true supports_getinfo = true If you add those settings to your commands.conf it should work Splunk's OWN DOCS AND EXAMPLES IN MULTIPLE PLACES say "chunked = true" specifies search command protocol version 2 Like here https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/createcustomsearchcmd#Register-your-custom-search-command And here https://docs.splunk.com/Documentation/ITSI/4.12.0/Configure/commands.conf And here https://github.com/splunk/splunk-sdk-python/blob/master/examples/searchcommands_app/package/default/commands.conf Wow.   ... View more

I'm having the same issue. Actually after pulling my hair out over it, copied the generatetext command example from Splunk SDK for Python GitHub repo into my instance https://github.com/splunk/splunk-sdk-python/blob/master/examples/searchcommands_app/package/bin/generatetext.py Copied default/commands.conf. Setup splunklib directory. Splunk v8.2.2, should play nicely with python3 Still failing with this error. Did you ever solve it? ... View more

I was able to solve this by putting the condition in the first line of the search, like this: index=alerts data.rule.name="Target Trends, Trending Targets in Watch List" It still bugs me that | where like() isn't working the way I'd expect it to, if anyone has advice I am all ears! ... View more