Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Custom search command: preop only works when retainevents is false?

$
0
0

I have a questions about custom search commands and the streaming_preop option. Is there some reason why the preopt is only honored if retevs (retainsevents) is false?

I have a situation where I would like to run a pre-processing command, and I want my search script to return events not results. As soon as I set retevs=True, then the pre-operation search command is not executed. There are other limitations on the streaming_preop listed in the docs, but there is nothing mentioned about any conflicts with retainsevents.

Just to be clear, this results in "addinfo" being called:

 # streaming, generating, retevs, reqsop, preop
 splunk.Intersplunk.outputInfo(False, False, False, True, "addinfo")

But, in this case "addinfo" is NOT called before my search command:

 # streaming, generating, retevs, reqsop, preop
 splunk.Intersplunk.outputInfo(False, False, True, True, "addinfo")

Any ideas?


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>