topic Why does Splunk scripted input not print data when script is turned off? in Splunk Dev

Why does Splunk scripted input not print data when script is turned off?

sumeet — Fri, 30 Sep 2022 06:20:49 GMT

Hello,

I am using python script to read from remote api with pagination. I have one problem while reading data from api, once i started script and it pulls data after that if i disable the script the data does not get printed in splunk though it has passed through print statement.

Re: Why does Splunk scripted input not print data when script is turned off?

isoutamo — Fri, 30 Sep 2022 10:43:43 GMT

Maybe I don' understand this right, but when you have disabled input then splunk don't run that script until you are reenabling that input.

Re: Why does Splunk scripted input not print data when script is turned off?

sumeet — Fri, 30 Sep 2022 11:33:07 GMT

Hi @isoutamo

In the below method we are looping through data and sending each event to splunk(for indexing) using print method. So while executing this method if we disable script through ui, it does not index any event to splunk and program is immediately terminated.

For example: We have 5 events to be indexed. So the for loop should execute print 5 times. Now, suppose it has executed it 2 times and now we disable the script through UI. Then the script will be terminated immediately and the two events which were sent using print function will also not be indexed.

Is it expected behaviour and how we could handle such cases gracefully?

My code is like this:

def stream_to_splunk(self, data): for event in data: jsonData = json.dumps({"sourceType": self.sourceType, "event": event}) print(jsonData)

Re: Why does Splunk scripted input not print data when script is turned off?

isoutamo — Fri, 30 Sep 2022 14:01:00 GMT

I cannot recall how this has implemented, but my gut feelings is that this is how it has planned to working. I think that there is some buffering on sending events to splunk and when you are "stopping" it before it has finished it don't sent any events as it has just terminated and all buffers are cleared.