Documentation: 3.3
|  Print Version Contents
This page last updated: 10/01/08 04:10pm

commands.conf

Use this file to create custom search commands.

commands.conf.spec

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.0 
#
# This file contains possible attribute/value pairs for creating search commands for 
# any custom search scripts created.  Add your custom search script to $SPLUNK_HOME/etc/searchscripts/
# or $SPLUNK_HOME/apps/MY_APP/bin/.  For the latter, put a custom commands.conf in 
# $SPLUNK_HOME/apps/MY_APP.  For the former, put your custom commands.conf 
# in $SPLUNK_HOME/etc/system/local/.

# There is a commands.conf in $SPLUNK_HOME/etc/system/default/.  For examples, see 
# commands.conf.example.  You must restart Splunk to enable configurations.

# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/doc/latest/admin/BundlesIntro.

[$STANZA_NAME]
    * Each stanza represents a search command; the command is the stanza name.
    * The stanza name invokes the command in the search language.
    * Set the following attributes/values for the command.  Otherwise, Splunk uses the defaults.

type = <string>
    * Type of script: python, perl
    * Defaults to python.

filename = <string>
    * Name of script file for command.
    * <stanza-name>.pl for perl.
    * <stanza-name>.py for python.

streaming = <true/false>
    * Is the command streamable.
    * Defaults to false.
    
maxinputs = <integer>
    * Maximum number of events that can be passed to the command for each invocation.
    * 0 for no limit.
    * Defaults to 50000.

passauth = <true/false>
    * If set to true, passes an authentication token on the start of input.
    * Defaults to false.
    
enableheader = <true/false>
    * Indicate whether or not your script is expecting header information or not.
    * Currently, the only thing in the header information is an auth token.
    * Defaults to true.

commands.conf.example

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.0 

# This is an example commands.conf.  Use this to configure custom search commands.
#
# To use one or more of these configurations, copy the configuration block into commands.conf 
# in $SPLUNK_HOME/etc/system/local/.  You must restart Splunk to enable configurations.

# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/doc/latest/admin/BundlesIntro.

# NOTE: Add your custom search script to $SPLUNK_HOME/etc/searchscripts/
# or $SPLUNK_HOME/apps/MY_APP/bin/.  For the latter, put a custom commands.conf in 
# $SPLUNK_HOME/apps/MY_APP/.  For the former, put your custom commands.conf 
# in $SPLUNK_HOME/etc/system/local/.

[foo]
FILENAME = foo.pl
type = perl

[black_smoke]
FILENAME = black_smoke.py
Previous: authorize.conf    |    Next: crawl.conf

Comments

No comments have been submitted.

Log in to comment.