When to write a command

Given the warning about performance, there are still times when it makes sense to write a command. I can think of a few reasons:

  • You need to perform a specific action that cannot be accomplished using internal commands
  • You need to talk to an external system (a lookup may be more efficient though)
  • You need to produce events out of thin air, perhaps from an external service or for testing

I'm sure you can think of your own reasons. Let's explore the nuts and bolts of different types of commands.

Get Implementing Splunk 7 - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.