topic Re: Splunk Add-on Builder: When editing the script, how can I go about logging specific things to Splunk that can be searched for? in All Apps and Add-ons

Splunk Add-on Builder: When editing the script, how can I go about logging specific things to Splunk that can be searched for?

larryleeroberts — Thu, 02 Feb 2017 15:00:11 GMT

I am working on the Splunk Add-On Builder and so far really liking it. It's making me learn Python 🙂
I do have one question though that I can not seem to find an answer too. When I am editing the script in the Add-On Builder, how can I go about logging specific things to Splunk that can be searched for?

For example, I am building a customized alert. When used, I would like to log to Splunk something like...
"Splunk alert for was triggered on "

I would also like to specify the source.

I can not seem to find any example of this. Can anyone provide a code example?

Thank you!

Re: Splunk Add-on Builder: When editing the script, how can I go about logging specific things to Splunk that can be searched for?

larryleeroberts — Tue, 29 Sep 2020 12:42:33 GMT

Found my own answer looking right at me 🙂
helper.addevent("hello", sourcetype="sample_sourcetype")
helper.addevent("world", sourcetype="sample_sourcetype")
helper.writeevents(index="summary", host="localhost", source="localhost")

Re: Splunk Add-on Builder: When editing the script, how can I go about logging specific things to Splunk that can be searched for?

ehaddad_splunk — Tue, 29 Sep 2020 12:39:36 GMT

The above helper functions are to index the data.
If you want your alert action to log info to internal logs, you can use
helper.log_info("my info message")
helper.log_error("my error message")
There are example of helper.log_info in commented area that you can leverage

Re: Splunk Add-on Builder: When editing the script, how can I go about logging specific things to Splunk that can be searched for?

larryleeroberts — Fri, 03 Feb 2017 13:59:00 GMT

Thanks!!!!