All Apps and Add-ons

How to index errors and exceptions in case of connection problem to remote host

kvaga
Explorer

Hi!
I’m getting the following errors in results of query:

>index=_internal ExecProcessor error rest.py

06-01-2018 14:56:19.657 +0300 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/rest_ta/bin/rest.py" Exception performing request: HTTPConnectionPool(host='test-host.ru', port=9080): Max retries exceeded with url: /config/healthcheck (Caused by <class 'socket.error'>: [Errno 111] Connection refused)

But when I execute the query:

index="test_2" | spath | timechart span=30s count by body

I have a response which successfully executed without errors. I have to index errors for a future reflection on my dashboard.

In properties set of a rest data input I've checked the checkbox: “Index Error Responses” (Whether or not to index error response codes, defaults to false). No luck
How can I get the errors in my index test_2?

0 Karma

Richfez
SplunkTrust
SplunkTrust

Well, I won't answer this so the app creator can chime in or fix that option, but for now, one thing you could do as a workaround...

index="test_2" OR (index=_internal ExecProcessor error rest.py) ....

That should just make those show up in the search directly.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...