Skip to content

Error thrown by /usr/local/lib/python3.10/dist-packages/splunklib/searchcommands/search_command.py while chunked=true is set #605

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
klawrencegupta-splunk opened this issue Mar 17, 2025 · 0 comments

Comments

@klawrencegupta-splunk
Copy link

Describe the bug
While defining a new python command in the commands.conf & setting chunked=true

/usr/local/lib/python3.10/dist-packages/splunklib/searchcommands/search_command.py
continues to throw the following error

Even with chunked = true set in the commands.conf kept getting the following error
ERROR: Command streamingSpledis appears to be statically configured for search command protocol version 1 and static '
'configuration is unsupported by splunklib.searchcommands. Please ensure that '
'default/commands.conf contains this stanza:\n'

To Reproduce
https://github.com/splunk/fishstix/blob/main/fishstix_spl/fishstix/default/commands.conf
https://github.com/splunk/fishstix/blob/main/fishstix_spl/fishstix/bin/spledis.py *references splunklib

Expected behavior
defined command.conf will continue
Even with chunked = true keeps producing the following errors
ERROR: Command streamingSpledis appears to be statically configured for search command protocol version 1 and static '
'configuration is unsupported by splunklib.searchcommands. Please ensure that '
'default/commands.conf contains this stanza:\n'

I eventually had to modify /usr/local/lib/python3.10/dist-packages/splunklib/searchcommands/search_command.py to skip the check for v1 so it would only run in v2

def process(self, argv=sys.argv, ifile=sys.stdin, ofile=sys.stdout, allow_empty_input=True):
""" Process data.
:param argv: Command line arguments.
:type argv: list or tuple
:param ifile: Input data file.
:type ifile: file
:param ofile: Output data file.
:type ofile: file
:param allow_empty_input: Allow empty input records for the command, if False an Error will be returned if empty chunk body is encountered when read
:type allow_empty_input: bool
:return: :const:None
:rtype: NoneType
"""
self._allow_empty_input = allow_empty_input
if len(argv) > 1:
self._process_protocol_v2(argv, ifile, ofile) #changed from v1 to v2 to skip the check altogether
else:
self._process_protocol_v2(argv, ifile, ofile)

Logs or Screenshots
If applicable, add logs or screenshots to help explain your problem.

Splunk (please complete the following information):

  • Version: 9.4.0
  • OS: Ubuntu 22.04
  • Deployment: single-instance

SDK (please complete the following information):

  • Version: [e.g. 1.6.14]
  • Language Runtime Version: [e.g. Python 3.7]
  • OS: [e.g. MacOS 10.15.7]

Additional context
Add any other context about the problem here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant