All Apps and Add-ons

Splunk Add-on Builder: When editing the script, how can I go about logging specific things to Splunk that can be searched for?

larryleeroberts
Path Finder

I am working on the Splunk Add-On Builder and so far really liking it. It's making me learn Python 🙂
I do have one question though that I can not seem to find an answer too. When I am editing the script in the Add-On Builder, how can I go about logging specific things to Splunk that can be searched for?

For example, I am building a customized alert. When used, I would like to log to Splunk something like...
"Splunk alert for was triggered on "

I would also like to specify the source.

I can not seem to find any example of this. Can anyone provide a code example?

Thank you!

0 Karma
1 Solution

larryleeroberts
Path Finder

Found my own answer looking right at me 🙂
helper.addevent("hello", sourcetype="sample_sourcetype")
helper.addevent("world", sourcetype="sample_sourcetype")
helper.writeevents(index="summary", host="localhost", source="localhost")

View solution in original post

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

The above helper functions are to index the data.
If you want your alert action to log info to internal logs, you can use
helper.log_info("my info message")
helper.log_error("my error message")
There are example of helper.log_info in commented area that you can leverage

0 Karma

larryleeroberts
Path Finder

Thanks!!!!

0 Karma

larryleeroberts
Path Finder

Found my own answer looking right at me 🙂
helper.addevent("hello", sourcetype="sample_sourcetype")
helper.addevent("world", sourcetype="sample_sourcetype")
helper.writeevents(index="summary", host="localhost", source="localhost")

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...