Building for the Splunk Platform

Why do Custom command not stay local to search heads?

oliverja
Path Finder
 

(Search head cluster/indexer cluster environment)

I have written a custom search, using the template provided by Splunk for streaming commands.

In an attempt to force the search to run on the search heads and not on the indexers, I added the @Configuration(local=True) bit to the code.

 

 

 

from splunklib.searchcommands import dispatch, StreamingCommand, Configuration, Option, validators


@Configuration(local=True)
class StreamingCSC(StreamingCommand):

 

 

 

I got that change from here:

https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/pythonclassescustom/

but the search still dies.

oliverja_1-1656582943847.png

If i modify my search to put the |sort something | mycustomcommand, the search is forced to run locally and it works fine.

What am I doing wrong in trying to keep this search off the indexers and only on the search head cluster?

Labels (2)
0 Karma
1 Solution

oliverja
Path Finder

I was not able to get the (local=True) to work properly, but I fixed the issue by moving the splunklib folder from "lib" to "bin". An alternative would have been to change the distsearch.conf to add my lib folder to the whitelist, but this impacts all apps, and I did not want to mess with other configs. This change keeps the change local to the app I made.

View solution in original post

0 Karma

oliverja
Path Finder

I was not able to get the (local=True) to work properly, but I fixed the issue by moving the splunklib folder from "lib" to "bin". An alternative would have been to change the distsearch.conf to add my lib folder to the whitelist, but this impacts all apps, and I did not want to mess with other configs. This change keeps the change local to the app I made.

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...