commands.conf

commands.conf

The following are the spec and example files for commands.conf.

commands.conf.spec

# Copyright (C) 2005-2010 Splunk Inc.  All Rights Reserved.  Version 4.0 
#
# This file contains possible attribute/value pairs for creating search commands for 
# any custom search scripts created.  Add your custom search script to $SPLUNK_HOME/etc/searchscripts/
# or $SPLUNK_HOME/apps/MY_APP/bin/.  For the latter, put a custom commands.conf in 
# $SPLUNK_HOME/apps/MY_APP.  For the former, put your custom commands.conf 
# in $SPLUNK_HOME/etc/system/local/.

# There is a commands.conf in $SPLUNK_HOME/etc/system/default/.  For examples, see 
# commands.conf.example.  You must restart Splunk to enable configurations.

# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/Aboutconfigurationfiles


[$STANZA_NAME]
	* Each stanza represents a search command; the command is the stanza name.
	* The stanza name invokes the command in the search language.
	* Set the following attributes/values for the command.  Otherwise, Splunk uses the defaults.

type = <string>
	* Type of script: python, perl
	* Defaults to python.

filename = <string>
	* Name of script file for command.
	* <stanza-name>.pl for perl.
	* <stanza-name>.py for python.

streaming = <true/false>
	* Is the command streamable.
	* Defaults to false.
	
maxinputs = <integer>
	* Maximum number of events that can be passed to the command for each invocation.
	* 0 for no limit.
	* Defaults to 50000.

passauth = <true/false>
	* If set to true, passes an authentication token on the start of input.
	* Defaults to false.

run_in_preview = <true/false>
	* Run this command if we generating results just for preview rather than final output?
	* Defaults to true
       	
enableheader = <true/false>
	* Indicate whether or not your script is expecting header information or not.
	* Currently, the only thing in the header information is an auth token.
	* If set to true it will expect as input a head section + '\n' then the csv input
	* NOTE: Should be set to true if you use splunk.Intersplunk
	* Defaults to true.

retainsevents = <true/false>
	* Does command retain events?
		* e.g. sort/dedup/cluster.
	* Or does it transform them 
		e.g. stats.
	* Defaults to false.

generating = <true/false>
	* Does your command generate new events
		* eg if the no events are passed to the command, will it generate events?
	* Defaults to false.

generates_timeorder = <true/false>
        * If generating = true, does command generate events in descending time order (latest first)
	* Defaults to false.

overrides_timeorder = <true/false>
        * If generating = false, does command change the order of events with respect to time
	* Defaults to true.

requires_preop
	* require pre-streaming operations
	* Defaults to false.

streaming_preop = <string>
	* A string that denotes the requested pre-streaming search string.

supports_multivalues = <true/false>
	* Does command support multivalues.  If true, multivalues will be treated as python lists of strings instead of a flat string (when using Intersplunk to interpret stdin/stdout)
	     
supports_getinfo = <true/false>
	* Does the command support dynamic probing for settings via the first argument 
	being invoked == __GETINFO__ or __EXECUTE__.

commands.conf.example

# Copyright (C) 2005-2010 Splunk Inc.  All Rights Reserved.  Version 4.0 
#
# Configuration for external search commands
#

##############
# defaults for all external commands, exceptions are below in individual stanzas

# type of script: 'python', 'perl'
TYPE = python
#default FILENAME would be <stanza-name>.py for python, <stanza-name>.pl for perl and <stanza-name> otherwise

# is command streamable?
STREAMING = false

# maximum data that can be passed to command (0 = no limit)
MAXINPUTS = 50000

# end defaults
#####################

[crawl]
FILENAME = crawl.py

[createrss]
FILENAME = createrss.py

[diff]
FILENAME = diff.py

[gentimes]
FILENAME = gentimes.py

[head]
FILENAME = head.py

[iplocation]
FILENAME = iplocation.py

[loglady]
FILENAME = loglady.py

[marklar]
FILENAME = marklar.py

[runshellscript]
FILENAME = runshellscript.py

[sendemail]
FILENAME = sendemail.py

[translate]
FILENAME = translate.py

[transpose]
FILENAME = transpose.py

[uniq]
FILENAME = uniq.py

[windbag]
filename = windbag.py
supports_multivalues = true

[xmlkv]
FILENAME = xmlkv.py

[xmlunescape]
FILENAME = xmlunescape.py

• Was this topic useful?
• Post a comment