topic No output from modular input_ta in Getting Data In

No output from modular input_ta

kkentsplunk — Wed, 23 Oct 2013 16:03:18 GMT

I cant seem to get my modular input to write anything when I package, import, and run it. I have created a scripted input that works great. It queries some endpoints and write some formatted data to Splunk. I am trying to turn it into a modular input.

I am using modular input framework from @damien-dallimore. I package the app, load it, and get nothing. In my main do_run() it is using print to write out data but nothing appears in Splunk. I get no errors in splunkd, and no logging messages. The only thing i see in splunkd is:

10-23-2013 08:41:59.661 -0700 INFO ExecProcessor - Ran script: python "C:\Program Files\Splunk\etc\apps\Appname_ta\bin\Appname.py", took 17.01 seconds to run, 0 bytes read

I tried inserting some logging as shown here and even that doesn't show up.

if __name__ == '__main__': logging.error("running the main thread") if len(sys.argv) > 1: if sys.argv[1] == "--scheme": logging.error("scheme present, running scheme")

Any idea on what my next debugging step might be?

Thanks

Re: No output from modular input_ta

alacercogitatus — Wed, 23 Oct 2013 17:28:48 GMT

Try running this, replacing the $MI$ variable with the name of your modualar input:

splunk cmd splunkd print-modinput-config $MI$ $MI$://$YOUR_CONF_STANZA$ \ | splunk cmd python $SPLUNK_HOME/etc/apps/$YOUR_APP$/bin/$YOUR_APP$.py

Re: No output from modular input_ta

Damien_Dallimor — Thu, 24 Oct 2013 05:05:28 GMT

Just to add.....

Is your logging level set to ERROR ?

logging.root.setLevel(logging.ERROR)

Also there is a also a "helloworld" example you can use and build out from : https://github.com/damiendallimore/SplunkModularInputsPythonFramework/tree/master/implementations/helloworld