Splunk Search

Is it safe to make a folder in $SPLUNK_HOME/var/run/dispatch?

matutter4
Explorer

I'm writing a custom search command filter that's designed to use pythons tempfile.gettempdir. I see that Splunk uses the environment variable which gettempdir returns as the location for Splunk's dispatch directory. I also want to use the value of gettempdir to make a single folder and write files into that folder.

Is it safe to use the dispatch directory set by Splunk for my own uses? Is it safe if I only use folder's that don't conflict with Splunk's dispatch naming conventions?

0 Karma
1 Solution

ddrillic
Ultra Champion

Really, it's against the best practice of any software. For supportability, you don't want this kind of dual purpose locations.

View solution in original post

ddrillic
Ultra Champion

Really, it's against the best practice of any software. For supportability, you don't want this kind of dual purpose locations.

matutter4
Explorer

I did a few tests with using the tempfile.gettempdir and it worked fine without any issues. I didn't try to use a path that is used by splunk within the dispatch directory but I imagine that would causes issue. As @ddrillic said it isn't a good practice; and so I just replaced the use of gettempdir with a variable read with splunk.splunklib.cli_common.getConfKeyValue from a config file when my search-command runs.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...