All Apps and Add-ons

Splunk Add-on Builder: When editing the script, how can I go about logging specific things to Splunk that can be searched for?

larryleeroberts
Path Finder

I am working on the Splunk Add-On Builder and so far really liking it. It's making me learn Python 🙂
I do have one question though that I can not seem to find an answer too. When I am editing the script in the Add-On Builder, how can I go about logging specific things to Splunk that can be searched for?

For example, I am building a customized alert. When used, I would like to log to Splunk something like...
"Splunk alert for was triggered on "

I would also like to specify the source.

I can not seem to find any example of this. Can anyone provide a code example?

Thank you!

0 Karma
1 Solution

larryleeroberts
Path Finder

Found my own answer looking right at me 🙂
helper.addevent("hello", sourcetype="sample_sourcetype")
helper.addevent("world", sourcetype="sample_sourcetype")
helper.writeevents(index="summary", host="localhost", source="localhost")

View solution in original post

0 Karma

ehaddad_splunk
Splunk Employee
Splunk Employee

The above helper functions are to index the data.
If you want your alert action to log info to internal logs, you can use
helper.log_info("my info message")
helper.log_error("my error message")
There are example of helper.log_info in commented area that you can leverage

0 Karma

larryleeroberts
Path Finder

Thanks!!!!

0 Karma

larryleeroberts
Path Finder

Found my own answer looking right at me 🙂
helper.addevent("hello", sourcetype="sample_sourcetype")
helper.addevent("world", sourcetype="sample_sourcetype")
helper.writeevents(index="summary", host="localhost", source="localhost")

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...