All Apps and Add-ons

Splunk Add-on Builder: When editing the script, how can I go about logging specific things to Splunk that can be searched for?

larryleeroberts
Path Finder

I am working on the Splunk Add-On Builder and so far really liking it. It's making me learn Python 🙂
I do have one question though that I can not seem to find an answer too. When I am editing the script in the Add-On Builder, how can I go about logging specific things to Splunk that can be searched for?

For example, I am building a customized alert. When used, I would like to log to Splunk something like...
"Splunk alert for was triggered on "

I would also like to specify the source.

I can not seem to find any example of this. Can anyone provide a code example?

Thank you!

0 Karma
1 Solution

larryleeroberts
Path Finder

Found my own answer looking right at me 🙂
helper.addevent("hello", sourcetype="sample_sourcetype")
helper.addevent("world", sourcetype="sample_sourcetype")
helper.writeevents(index="summary", host="localhost", source="localhost")

View solution in original post

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

The above helper functions are to index the data.
If you want your alert action to log info to internal logs, you can use
helper.log_info("my info message")
helper.log_error("my error message")
There are example of helper.log_info in commented area that you can leverage

0 Karma

larryleeroberts
Path Finder

Thanks!!!!

0 Karma

larryleeroberts
Path Finder

Found my own answer looking right at me 🙂
helper.addevent("hello", sourcetype="sample_sourcetype")
helper.addevent("world", sourcetype="sample_sourcetype")
helper.writeevents(index="summary", host="localhost", source="localhost")

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...