topic Is it possible to have a separate log file for errors occurring only within a specific Splunk App? in Getting Data In

Is it possible to have a separate log file for errors occurring only within a specific Splunk App?

mariasudolska — Tue, 16 Jan 2018 15:03:39 GMT

Hi all,

I am posting this question because I was not able to find the answer so far. I know that Splunk logs a lot about itself and that there are various log files in $SPLUNK_HOME/var/log/splunk. However, I would like to know whether it is possible to keep a separate log file that would contain only errors (and other messages) related to using a specific Splunk App, e.g. Search & Reporting or any custom developed App. Or in other words: when I develop a Splunk App, is it possible to specify something like an App error log?

If it is not possible at all, then the only option to search for errors would be to write specific searches for index=_internal and filter out the relevant information, is that right?

Thanks a lot.

Re: Is it possible to have a separate log file for errors occurring only within a specific Splunk App?

nickhills — Tue, 16 Jan 2018 15:58:06 GMT

Many Splunk apps write log lines into their own files for scripted/modular inputs, custom commands a lookups.
If your building your inputs in Python you can use the SDK to do the same
http://dev.splunk.com/view/logging/SP-CAAAFCN

Re: Is it possible to have a separate log file for errors occurring only within a specific Splunk App?

mariasudolska — Wed, 24 Jan 2018 14:17:36 GMT

Many thanks for the answer.