-
Notifications
You must be signed in to change notification settings - Fork 369
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Examples do not work in distributed search #418
Comments
Hey @Bre77
|
I have tested this in both the current Splunk Cloud version and the latest Splunk Enterprise version. My distributed environment was an index cluster with the TA only installed on the search head. Issue can easily be reproduced by installing any version 0.1.x of https://splunkbase.splunk.com/app/6161/ on a search head with distributed search. I fixed this issue in 1.0.0 by moving the lib directory inside bin. |
I believe this documentation needs to be implemented into the example: https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/packageanddeploycustom/#Deploy-a-streaming-command-on-an-indexer |
Thanks so much for raising this issue, @Bre77 The correct solution is so include a distsearch.conf file with the /lib directory added to the replication allow list. |
Hi @Bre77,
We have installed (.tar of) searchcommands_app (comprises of several custom search commands) located in python-sdk repo.
Please let us know, if we missed anything. |
@bparmar-splunk where was the search command installed in your test? Only Search Heads or on the indexers too? |
@bparmar-splunk thats why you couldn't reproduce. Try installing a streaming search command only on the search head. It will be distributed to the indexers in the knowledge bundle, but be missing the splunklib directory because the provided example does not include a distsearch.conf as per the Splunk Dev docs: https://dev.splunk.com/enterprise/docs/devtools/customsearchcommands/packageanddeploycustom/#Deploy-a-streaming-command-on-an-indexer |
The example code for Streaming Search commands, does not work in a distributed search environment, because the %app%/lib directory is not included in bundle replication.
splunk-sdk-python/examples/searchcommands_template/bin/stream.py
Line 6 in 2199b5e
The lib directory needs to instead be located inside bin, or a distsearch.conf should be included, or I guess a note about it has to be installed on the indexers just so it has access to Splunklib.
The text was updated successfully, but these errors were encountered: