In my company we set up our Splunk to use a Search Head Cluster and a Indexer Cluster but I want to make a separate Splunk instance (not in the sh-cluster) use the indexers. This is meant to be a "developers" instance and I want to keep the environment to a minimum by opting out of things like shcluster redeploys, bundle replication, scheduled searches, etc... Is there a way to configure a search head to work like this? ... View more

I'm writing a custom search command filter that's designed to use pythons tempfile.gettempdir . I see that Splunk uses the environment variable which gettempdir returns as the location for Splunk's dispatch directory. I also want to use the value of gettempdir to make a single folder and write files into that folder. Is it safe to use the dispatch directory set by Splunk for my own uses? Is it safe if I only use folder's that don't conflict with Splunk's dispatch naming conventions? ... View more

I've taken the "generatetext.py" example from the SDK and I'd like to run it directly from my terminal. However, I get the exception below whenever Splunk lib enters _process_protocol_v2 and calls self._read_chunk which in turn returns None when it fails to get the "header". How do I get around this obstacle in running my custom command script by hand? The error: Traceback (most recent call last): File "/usr/lib64/python2.7/logging/handlers.py", line 76, in emit if self.shouldRollover(record): File "/usr/lib64/python2.7/logging/handlers.py", line 155, in shouldRollover self.stream.seek(0, 2) #due to non-posix-compliant Windows feature File "/usr/lib64/python2.7/codecs.py", line 703, in seek self.stream.seek(offset, whence) IOError: [Errno 29] Illegal seek Logged from file search_command.py, line 971 chunked 1.0,239,0 {"inspector":{"messages":[["ERROR","TypeError at \"/home/mat/splunk-sdk-python/examples/searchcommands_app/package/bin/packages/splunklib/searchcommands/search_command.py\", line 650 : 'NoneType' object is not iterable"]]},"finished":true} ... View more

I have several apps I update directly from github into my /opt/splunk/etc/shcluster/apps directory. The apps each contain their own .git folder. Is there a way to ignore .git/ in every app so they aren't replicated across my Searchheads? ... View more

I have a small Splunk setup with a just a search head, indexer, and forwarder. I've been installing apps and restarting them by hand, but I'd like to set up a deployment server to do that for me. If I have an app that I only want to run on my search head, will it also be deployed to the indexer and forwarder? How do I specify what serverclass an app is deployed to? ... View more