splunk SDK notes

Here’s an annoying one when building a custom splunk search command using the python SDK:

"Error in 'script': Getinfo probe failed for external search command 'testscript'"

This mean you have:

1. "supports_getinfo = true" set in commands.conf for that particular command
2. failed to set a docstring for one of the splunk elements within the command.
   1. Check your instances of Option and set doc=""
   2. Set a docstring for the class itself, but you already did that anyhow, didn’t you? 🙂

Another issue that may occur is this one:

AttributeError: The value of configuration setting streaming is managed

This means you’ve tried to set streaming=true in the @Configuration of the class. Put it in commands.conf and you’ll be fine.