topic Re: Uploading files with python-sdk in Splunk Dev

Having trouble uploading log files with python-sdk - no errors, but don't see logs on indexes?

haktor5 — Thu, 18 Jun 2020 18:15:36 GMT

I am working on a python script to upload logs to an index on the local Splunk server. I use splunk-sdk for python for this.

Connection and some splunk-sdk example runs fine but I am having trouble when uploading logs.

When i run the upload.py script with the file to be uploaded command runs with no error but I don't see the logs on any index. So far I tried:

1. using the example script on github python-sdk page
2. implementing upload() method with indexes class described here: https://docs.splunk.com/DocumentationStatic/PythonSDK/1.6.5/client.html#splunklib.client.Index.upload
3. Implementing oneshot() method with inputs class

None of the above worked.

What am i doing wrong? Is there any way to have some feedback on why the file wasn't uploaded?

http://dev.splunk.com/view/python-sdk/SP-CAAAEE6#createinput
http://dev.splunk.com/view/python-sdk/SP-CAAAEE6
http://dev.splunk.com/view/python-sdk/SP-CAAAEFK#upload

Re: Uploading files with python-sdk

starcher — Wed, 17 Apr 2019 20:03:37 GMT

You would be much better off sending the logs in via HTTP Event Collector (HEC) if you are already operating in python. Read the file, blow in the events.

http://dev.splunk.com/view/event-collector/SP-CAAAE6M

Re: Uploading files with python-sdk

haktor5 — Wed, 17 Apr 2019 20:16:10 GMT

Thank you for the answer but my events are in a file and that's why I'm trying to use a method for file upload.

Re: Uploading files with python-sdk

vkannampuzha — Mon, 13 May 2019 06:12:28 GMT

Not sure why it doesn't work. I use python to upload data from a file to an index on my local Splunk. This is what I did

1. I installed splunk-sdk for python. Installed simply using the pip install command so:

pip install splunk-sdk

2. On python, you need to first connect to your local Splunk server

"""Connect to splunk local"""

import splunklib.client as client
import splunklib.results as results
from splunklib.binding import AuthenticationError

HOST=localhost
PORT = '8089'
USERNAME = 'username'
PASSWORD = 'password'

try:
    service = client.connect(host=HOST, port=PORT, username=USERNAME, password=PASSWORD)
except exception as e:
    print(str(e))

3. Upload your file to your index

myindex = service.indexes[ENTER INDEX NAME]  # Retrieve the index for the data

try:
    myindex.upload(ENTER THE ABSOLUTE PATH TO YOUR FILE)  # Upload file 
    to the index specified
except Exception as e:
    print(str(e))