topic Re: Why python file executes successfully to add data to an index through Splunk Python SDK, but no events are found in the index? in Splunk Dev

Why python file executes successfully to add data to an index through Splunk Python SDK, but no events are found in the index?

Bhuavana — Tue, 23 Dec 2014 12:09:12 GMT

Hi,
Im trying to add data to the index through Splunk Python SDK . Here .py file is executed successfully but no events found inside the index
Here are my code
import splunklib.client as client
import sys,os
import socket
............................

Create a Service instance and log in

service = client.connect(
host=HOST,
port=PORT,
username=USERNAME,
password=PASSWORD,
owner=OWNER,
app=APP)

Retrieve the index for the data

myindex = service.indexes["test_index"]

myindex = service.indexes.create("test_index2")

with myindex.attached_socket(sourcetype='test') as sock:

#sock.send("Test event\r\n")

sock.close()

Open a socket

mysocket = myindex.attach()

Send events to it

mysocket.send("This is my socket event\r\n")

Close the socket

mysocket.close()

print "everything done"

Code Type 2 :
import splunklib.client as client
import sys,os
.................................

Create a Service instance and log in

service = client.connect(
host=HOST,
port=PORT,
username=USERNAME,
password=PASSWORD,
owner=OWNER,
app=APP)

Retrieve the index for the data

myindex = service.indexes["test_index"]

Submit an event over HTTP

myindex.submit('This is my HTTP event',sourcetype='test', host='localhost')
Please verify and let me know what changes i have to do?

Re: Why python file executes successfully to add data to an index through Splunk Python SDK, but no events are found in the index?

kml_uvce — Tue, 23 Dec 2014 16:48:09 GMT

just checked without owner=OWNER,,app=APP . below code worked

service = client.connect(
host=HOST,
port=PORT,
username=USERNAME,
password=PASSWORD)

Retrieve the index for the data

myindex = service.indexes["test_index"]

Submit an event over HTTP

myindex.submit('This is my HTTP event',sourcetype='test', host='localhost')

need to investigate it...

Re: Why python file executes successfully to add data to an index through Splunk Python SDK, but no events are found in the index?

kairat — Mon, 09 Jul 2018 05:53:41 GMT

How about if there is long string, such as "37.31.31.31 - - [13/Dec/2015:23:08:40 +0100] ""POST /administrator/index.php HTTP/1.1"" 200 4494 """ ""Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0"" ""-""" Somehow it ignores it...

Re: Why python file executes successfully to add data to an index through Splunk Python SDK, but no events are found in the index?

kairat — Mon, 09 Jul 2018 08:18:09 GMT

The problem is about ": : : ". How to fix it????