Implementing Splunk 7, Third Edition - Third Edition

Configuring commands

Before we start writing commands, there is some setup that must be done for all commands. First, every command will need an entry in the commands.conf file of your app. Let's take a look at the following sample stanza:

[commandname] 
filename = scriptname.py 
streaming = false 
enableheader = true 
run_in_preview = true 
local = false 
retainsevents = false 

Go over the following attributes and their descriptions:

• [commandname]: The command available to search will be the title of the stanza, in this case, commandname.
• filename = scriptname.py: This is the script to run. It must live in the bin directory inside your app.
• streaming = false: By default, only one instance of each command will be run on the complete set of results. ...