topic Re: Why are we unable to index data to Splunk enterprise using Splunk addon? in Getting Data In

Why are we unable to index data to Splunk enterprise using Splunk addon?

bhuvanabala — Wed, 22 May 2019 06:02:38 GMT

I am new to Splunk addon builder. I am using splunk addon builder to build an addon that feeds the REST API response as input to Splunk enterprise. For this i am using Python modular input method. Since REST API modular input one of the data collection input doesnt supports Oauth2.0 we are using python modular input to get the REST API response

Before i feed the response to splunk enterprise, tried feeding some sample data using the below syntax

   def collect_events(helper, ew):
    event=helper.new_event(data="123",index="new_index",sourcetype="new_sourcetyp e)   
     ew.write_event(event)
     pass

I am able to print the output in console, but when i search for index="new_index" in search bar, its returing 0 events

Please let me know what i am missing here

Re: Why are we unable to index data to Splunk enterprise using Splunk addon?

DavidHourani — Wed, 22 May 2019 06:32:09 GMT

where are you writing the events to ?

Re: Why are we unable to index data to Splunk enterprise using Splunk addon?

bhuvanabala — Wed, 22 May 2019 06:37:14 GMT

Hi David,

Thanks for responding back.

I am tring to index the data under "new_index"(index name) and searched for the event in Search and Reporting App

Should i specify the App in the new_event() function

Re: Why are we unable to index data to Splunk enterprise using Splunk addon?

DavidHourani — Wed, 22 May 2019 07:00:18 GMT

Hi @bhuvanabala,

You can use the following link for reference :
http://dev.splunk.com/view/python-sdk/SP-CAAAEE6

There's an entire section about creating indexes and sending data there.

Also use this :
https://www.function1.com/2015/09/splunk-sdk-for-python-getting-data-in
It's a bit old but can still be used for reference.

Cheers,
David

Re: Why are we unable to index data to Splunk enterprise using Splunk addon?

suryajagarapu — Thu, 19 Mar 2020 19:05:55 GMT

I am also facing the same issue as the events are getting displayed in output console of AOB but it's showing zero events for the index.
Any thoughts please?

Re: Why are we unable to index data to Splunk enterprise using Splunk addon?

suryajagarapu — Thu, 19 Mar 2020 20:23:21 GMT

Hi @bhuvanabala , Could you please let me know what did you do fix the issue as I got stuck into the same situation and events are showing as 0 for the index though it's is displaying the event in output console?