topic Re: Why is setting up INFO Logging entries from custom modular inputs showing up as ERROR in splunkd? in Getting Data In

Why is setting up INFO Logging entries from custom modular inputs showing up as ERROR in splunkd?

phoenixdigital — Fri, 20 Jan 2017 05:12:40 GMT

Hi All,

So following the instructions here
https://docs.splunk.com/Documentation/Splunk/6.5.1/AdvancedDev/ModInputsLog

logging.root
logging.root.setLevel(logging.DEBUG) 
formatter = logging.Formatter('%(levelname)s,myapp=1,%(message)s')
handler = logging.StreamHandler(stream=sys.stderr)
handler.setFormatter(formatter)
logging.root.addHandler(handler)

# Turn down requests from spamming Splunkd logs
logging.getLogger("requests").setLevel(logging.WARNING)


logging.info("Started the Modular Input here")

This shows up in Splunkd as an ERROR in ExecProcessor

01-20-2017 15:01:46.147 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/myapp/bin/json_api.py" INFO,myapp=1,Started the Modular Input here

As you can see the submessage is correctly marked as INFO however the parent loglevel for splunkd is ERROR.

Is there any way to get this to show up as INFO for the splunkd.log?

Showing up as ERROR for splunkd is not right at all.

I tried using sys.stdout but that broke the whole thing for obvious reasons.

 handler = logging.StreamHandler(stream=sys.stdout)

Re: Why is setting up INFO Logging entries from custom modular inputs showing up as ERROR in splunkd?

acharlieh — Fri, 20 Jan 2017 13:08:11 GMT

ERROR is the default if no level is specified, whap happens if you change your format do that instead of a comma immediately after levelname you put a space instead?

Re: Why is setting up INFO Logging entries from custom modular inputs showing up as ERROR in splunkd?

phoenixdigital — Sun, 22 Jan 2017 22:20:07 GMT

That resolves it for modular inputs thank you.

It doesn't appear to help with custom setup handlers though.

01-23-2017 08:12:45.396 +1000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py setup':  INFO myapp=1,type=setup,starting
01-23-2017 08:12:44.788 +1000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py setup':  INFO myapp=1,type=setup,starting

From this custom endpoint
http://pastebin.com/2zMM8sak