topic Re: Where does Splunk store output of Python script? in Splunk Dev

Where does Splunk store output of Python script?

mrrci — Tue, 26 Apr 2022 18:30:29 GMT

Hey there Splunk community. I'm new here and I would appreciate some help if it is possible.

I wrote a Python script that generates a XML file when you run it. However, when I run it through Splunk I don't get the generated XML files as I usually do (when I run it in the console) in the same folder where the script is located.

Where do those XML files go? I can't find them,

Thanks!

Re: Where does Splunk store output of Python script?

richgalloway — Tue, 26 Apr 2022 20:11:14 GMT

We need more information. How is the XML file created? How is the file path specified? How is the file populated? Do you see any errors in Splunk's python.log file?

Re: Where does Splunk store output of Python script?

mrrci — Tue, 26 Apr 2022 20:16:35 GMT

It is created with Element Tree module in Python. Usually, when you run it from a console (I personally use Visual Studio Code), the XML file is written/generated in the same folder as the script itself (.py). Although, when I put the script in "/opt/splunk/etc/apps/myapp/bin" folder and run it with Splunk, the script is running but the XML file is not generated.

Re: Where does Splunk store output of Python script?

richgalloway — Tue, 26 Apr 2022 21:09:56 GMT

Please elaborate on "run it with Splunk" and say what you found in python.log.

Re: Where does Splunk store output of Python script?

mrrci — Tue, 26 Apr 2022 21:13:17 GMT

By "Run with Splunk" I mean to run as a custom scripted input (settings > data inputs > scripts). I'm not sure where to find python.log.

Re: Where does Splunk store output of Python script?

richgalloway — Wed, 27 Apr 2022 00:22:36 GMT

The python log is at $SPLUNK_HOME/var/log/splunk/python.log. Or, in SPL, index=_internal source=*python.log