Implementing Splunk 7, Third Edition - Third Edition

When to write a command

Given the warning about performance, there are still times when it makes sense to write a command. I can think of a few reasons:

• You need to perform a specific action that cannot be accomplished using internal commands
• You need to talk to an external system (a lookup may be more efficient though)
• You need to produce events out of thin air, perhaps from an external service or for testing

I'm sure you can think of your own reasons. Let's explore the nuts and bolts of different types of commands.