All Apps and Add-ons

Splunk Add-on Builder: When editing the script, how can I go about logging specific things to Splunk that can be searched for?

larryleeroberts
Path Finder

I am working on the Splunk Add-On Builder and so far really liking it. It's making me learn Python 🙂
I do have one question though that I can not seem to find an answer too. When I am editing the script in the Add-On Builder, how can I go about logging specific things to Splunk that can be searched for?

For example, I am building a customized alert. When used, I would like to log to Splunk something like...
"Splunk alert for was triggered on "

I would also like to specify the source.

I can not seem to find any example of this. Can anyone provide a code example?

Thank you!

0 Karma
1 Solution

larryleeroberts
Path Finder

Found my own answer looking right at me 🙂
helper.addevent("hello", sourcetype="sample_sourcetype")
helper.addevent("world", sourcetype="sample_sourcetype")
helper.writeevents(index="summary", host="localhost", source="localhost")

View solution in original post

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

The above helper functions are to index the data.
If you want your alert action to log info to internal logs, you can use
helper.log_info("my info message")
helper.log_error("my error message")
There are example of helper.log_info in commented area that you can leverage

0 Karma

larryleeroberts
Path Finder

Thanks!!!!

0 Karma

larryleeroberts
Path Finder

Found my own answer looking right at me 🙂
helper.addevent("hello", sourcetype="sample_sourcetype")
helper.addevent("world", sourcetype="sample_sourcetype")
helper.writeevents(index="summary", host="localhost", source="localhost")

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...