Configuration

• Command Arguments
• Daemon Settings
  • Pool Sizing
  • Timeouts
• Command Registration
• Alert Action
• Suppressing the Risky-command Warning
• Where State Lives
• Dependencies

Nearly everything has a sensible default. This page is what to change when it does not.

Command Arguments

inline and function are mutually exclusive, and one is required.

batch_size trades latency against throughput. Lower shows results sooner; higher amortises per-batch work over more events. Raise it when your snippet does expensive setup, lower it when an analyst is waiting.

index=web | exec inline="..." batch_size=512

Daemon Settings

Read from the daemon's environment when it starts. Because clients start it lazily, the cleanest way to set them is in $SPLUNK_HOME/etc/splunk-launch.conf so splunkd's environment carries them.

After changing any of them, restart the daemon so it picks them up:

pkill -f etc/apps/babysoarus/bin/babysoarus-daemon

The next search starts a new one.

Pool Sizing

Each warm instance holds a booted interpreter, so the pool trades memory for latency. The default of 16 per function suits a search head serving a team.

Raise it if many searches run concurrently and the daemon log shows frequent instantiated cold instance at debug. Lower it on a memory-constrained host. A cold instance is more expensive than a warm one but still small in absolute terms, and is rarely the thing worth optimising.

Timeouts

The execution budget is enforced by interrupting the guest, not by killing a process, so it is precise and cheap. A snippet that exceeds it fails that batch with a clear message.

Raise BABYSOARUS_TIMEOUT_EXECUTE_SECS if you make slow API calls from inside a snippet. Remember it applies per batch of 32 events, not per search.

Command Registration

default/commands.conf registers both search commands:

[exec]
filename = babysoarus-cmd
chunked = true
command.arg.1 = --mode
command.arg.2 = streaming
is_risky = true
run_in_preview = false

With chunked = true, Splunk honours only is_risky, maxwait, maxchunksize, filename, command.arg.<N>, python.version and run_in_preview. Everything else is negotiated in the protocol at run time.

Settings worth knowing about:

is_risky = true makes Splunk Web warn before running a search loaded from a link or URL. Keep it. The command runs arbitrary code.

run_in_preview = false stops the command running while a search is only generating previews. Since guest code can make outbound calls, doing the work twice would be wrong.

local = true, if you add it, forces the command onto the search head instead of letting Splunk distribute it to indexers.

To override any of these, put your changes in $SPLUNK_HOME/etc/apps/babysoarus/local/commands.conf rather than editing default/.

Alert Action

default/alert_actions.conf registers execalert:

[execalert]
is_custom = 1
label = Execute WASM/Python
payload_format = json
alert.execute.cmd = babysoarus-alert
alert.execute.cmd.arg.0 = --execute
max_results = 1000000000

param.inline =
param.function =
param.autocast =

max_results is the cap on rows handed to the action. Lower it if you would rather an alert processed a bounded sample than everything.

Suppressing the Risky-command Warning

Splunk warns whenever a search containing a risky command is loaded from a URL. On a shared search head that becomes noise, and administrators often turn it off globally in web.conf:

[settings]
enable_risky_command_check = false

Think about it before you do. The warning exists because commands like exec can run arbitrary code, and a link that silently runs a search is a real phishing vector. Restricting who may run the command with Splunk capabilities is a better answer than removing the warning for everyone.

Where State Lives

$SPLUNK_HOME/etc/apps/babysoarus/
  config/
    acl.json         network policy for guest egress, optional
    packages.json    Python packages to install, optional
  packages/
    installed.json   what the daemon believes it installed
    <modules>        unpacked wheels, read-only to guest code
  var/
    daemon.sock   mode 0600, owner only
    daemon.lock   single-instance lock
    daemon.log
    cache/        Wasmtime compiled-code cache
    cwasm/        precompiled components, named by content hash
    pycache/      bytecode for installed packages

The two files under config/ have their own chapters, because each is more than a key list: acl.json in Security model and packages.json in Dependencies.

Everything under var/ is regenerable. Deleting it costs one recompilation. packages/ is regenerable too, as long as config/packages.json still describes what should be there: the daemon rebuilds it on the next start.

Dependencies

Adding third-party Python packages to the interpreter has its own page: Dependencies.