Splunk Search

Which commands.conf should I add my custom search command to?

tristanmatthews
Path Finder

Hi,

Last week I defined a custom search command, and after reading the documentation I decided that I should reference it in:

$SPLUNK_HOME/etc/app/<app_name>/local

where my <app_name> is search because its a search command. So I created

$SPLUNK_HOME/etc/app/<app_name>/local/commands.conf

and put in a single santza for my command. Saved it, restarted splunk and tested it. After debugging worked great, so did all the normal search commands. Over the thanksgiving weekend my splunk started crashing. I think it unrelated and has todo with some security changes we made to the server, but wanted to double check that I didn't my "guess" about where to put it isn't destroying things. (btw its are still crashing once it remove the new commands.conf and restart so I'm fairly sure its not the problem).

-Tristan

Tags (1)
0 Karma
1 Solution

sbrant_splunk
Splunk Employee
Splunk Employee

If you want it in the context of your app, then you've put it in the correct spot.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationfiledirectories

One correction though, the path in your question should contain "apps", not "app":

$SPLUNK_HOME/etc/apps/<app_name>/local/commands.conf

View solution in original post

sbrant_splunk
Splunk Employee
Splunk Employee

If you want it in the context of your app, then you've put it in the correct spot.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationfiledirectories

One correction though, the path in your question should contain "apps", not "app":

$SPLUNK_HOME/etc/apps/<app_name>/local/commands.conf

sbrant_splunk
Splunk Employee
Splunk Employee

It doesn't need to be a copy of the default. Only new items or those that you want to override in default should go into local.

0 Karma

tristanmatthews
Path Finder

Your right it should be apps, and is in my install. The documentation:

http://docs.splunk.com/Documentation/Splunk/5.0.4/Search/AddthecustomcommandtoSplunk

which I copied the string from however lists the path incorrectly as "app".

Just to be painfully clear, my commands.conf should only have the single stanza for my command, it isn't a copy of the default with my command added?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...