Alerting

I am trying to debug a python script, but don't see any data in python.log. What can I do to get more information from python.log?

jbsplunk
Splunk Employee
Splunk Employee

I am attempting to do some debugging on a python script I've written to execute as an alert script. I've tried to edit the python logging settings in log.cfg but am unable to get any data that is useful in debugging the problem. Can I do something to alter the behavior so that I can get more information? Right now, all I see messages like this:

2014-02-04 11:22:19,552 -0400 INFO runshellscript:129 - 
1 Solution

jrodman
Splunk Employee
Splunk Employee

Generally, it probably makes sense to review what the other scripts that ship with splunk are doing. For example, sendemail.py is the most frequently used alert in the system. It arranges to log messages to python.log in the following way:

import (...) splunk.mining.dcutils as dcu
[...]
logger = dcu.getLogger()
[...]
logger.error(error_message_string)

Personally I'd do a slightly simpler

import splunk.mining.dcutils
logger = splunk.mining.dcutils.getLogger()

The way this is used within the script is to catch exceptions and then render them into log messages. eg

except Exception, e:
      logger.error("Could not get email credentials from splunk, using no credentials. Error: %s" % (str(e)))

If you need more context, such as the full exception, you can use normal python methods to render the exception to a string, eg

logger.error(traceback.format_exc())

see https://docs.python.org/2.7/library/traceback.html for more.

View solution in original post

jrodman
Splunk Employee
Splunk Employee

Generally, it probably makes sense to review what the other scripts that ship with splunk are doing. For example, sendemail.py is the most frequently used alert in the system. It arranges to log messages to python.log in the following way:

import (...) splunk.mining.dcutils as dcu
[...]
logger = dcu.getLogger()
[...]
logger.error(error_message_string)

Personally I'd do a slightly simpler

import splunk.mining.dcutils
logger = splunk.mining.dcutils.getLogger()

The way this is used within the script is to catch exceptions and then render them into log messages. eg

except Exception, e:
      logger.error("Could not get email credentials from splunk, using no credentials. Error: %s" % (str(e)))

If you need more context, such as the full exception, you can use normal python methods to render the exception to a string, eg

logger.error(traceback.format_exc())

see https://docs.python.org/2.7/library/traceback.html for more.

awurster
Contributor

absolutely brilliant. this sort of topic has been answered so many different times.. but this response is just so elegant, accurate and fresh.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...