I currently have a custom search command that works fine and returns results back to Splunk as desired. However, when calling out exceptions (say the python script encounters an unexpected error), I cannot get the error to display correctly in Splunk's UI. Any calls to Intersplunk's generateErrorResults simply returns an invalid heading error (which in fact is the same way I want to display my search command errors!)
For instance -
splunk.Intersplunk.generateErrorResults("Exception! %s (See mycommand.log)" % (e,))
Debugging this via CLI, I see this is formatted as expected for the outputResults() method and this is fine...except I am using outputStreamResults() in my command.
I've worked around it by doing the following -
except Exception, e: import traceback results=[] row={} stack = traceback.format_exc() row['_time'] = int(time.time()) row['error'] = str(str(e)) row['search']= " ".join(args) row['rawquery']= querystring results.append(row)si.outputStreamResults(results) logger.error(str(e) + ". Traceback: " + str(stack))
Which honestly just BARELY gets around the issue and does not properly show users when an error has occurred. How do I get my custom generating streaming search command to show errors in the UI like other search commands?