Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Error thrown by /usr/local/lib/python3.10/dist-packages/splunklib/searchcommands/search_command.py while chunked=true is set #605

Open
@klawrencegupta-splunk

Description

@klawrencegupta-splunk

Describe the bug
While defining a new python command in the commands.conf & setting chunked=true

/usr/local/lib/python3.10/dist-packages/splunklib/searchcommands/search_command.py
continues to throw the following error

Even with chunked = true set in the commands.conf kept getting the following error
ERROR: Command streamingSpledis appears to be statically configured for search command protocol version 1 and static '
'configuration is unsupported by splunklib.searchcommands. Please ensure that '
'default/commands.conf contains this stanza:\n'

To Reproduce
https://github.com/splunk/fishstix/blob/main/fishstix_spl/fishstix/default/commands.conf
https://github.com/splunk/fishstix/blob/main/fishstix_spl/fishstix/bin/spledis.py *references splunklib

Expected behavior
defined command.conf will continue
Even with chunked = true keeps producing the following errors
ERROR: Command streamingSpledis appears to be statically configured for search command protocol version 1 and static '
'configuration is unsupported by splunklib.searchcommands. Please ensure that '
'default/commands.conf contains this stanza:\n'

I eventually had to modify /usr/local/lib/python3.10/dist-packages/splunklib/searchcommands/search_command.py to skip the check for v1 so it would only run in v2

def process(self, argv=sys.argv, ifile=sys.stdin, ofile=sys.stdout, allow_empty_input=True):
""" Process data.
:param argv: Command line arguments.
:type argv: list or tuple
:param ifile: Input data file.
:type ifile: file
:param ofile: Output data file.
:type ofile: file
:param allow_empty_input: Allow empty input records for the command, if False an Error will be returned if empty chunk body is encountered when read
:type allow_empty_input: bool
:return: :const:None
:rtype: NoneType
"""
self._allow_empty_input = allow_empty_input
if len(argv) > 1:
self._process_protocol_v2(argv, ifile, ofile) #changed from v1 to v2 to skip the check altogether
else:
self._process_protocol_v2(argv, ifile, ofile)

Logs or Screenshots
If applicable, add logs or screenshots to help explain your problem.

Splunk (please complete the following information):

  • Version: 9.4.0
  • OS: Ubuntu 22.04
  • Deployment: single-instance

SDK (please complete the following information):

  • Version: [e.g. 1.6.14]
  • Language Runtime Version: [e.g. Python 3.7]
  • OS: [e.g. MacOS 10.15.7]

Additional context
Add any other context about the problem here.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions