Addon Builder 4.5.0,
Hello @spamarea1,
Would you be able to share the python code to check further why it is not ingesting events? And can you also confirm if ew.write_event(event) has been set properly? Did you also check on the Add-on Builder UI if it is ingesting events when you run the Test button?
Thanks,
Tejas.
Here is the code, I reused the template that the addon builder app started. The data input is also setup, it was built by the app, I have to give it a name and put the interval to 30 seconds.
Formatting here is not good....
# encoding = utf-8
import os
import sys
import time
import datetime
'''
IMPORTANT
Edit only the validate_input and collect_events functions.
Do not edit any other part in this file.
This file is generated only once when creating the modular input.
'''
'''
# For advanced users, if you want to create single instance mod input, uncomment this method.
def use_single_instance_mode():
return True
'''
def validate_input(helper, definition):
"""Implement your own validation logic to validate the input stanza configurations"""
# This example accesses the modular input variable
# password = definition.parameters.get('password', None)
# username = definition.parameters.get('username', None)
# finesse_ip = definition.parameters.get('finesse_ip', None)
pass
def collect_events(helper, ew):
import requests
from requests.auth import HTTPBasicAuth
finesse_ip = helper.get_arg('finesse_ip')
username = helper.get_arg('username')
password = helper.get_arg('password')
url = f"https://{finesse_ip}/finesse/api/SystemInfo"
try:
response = requests.get(url, auth=HTTPBasicAuth(username, password), verify=False)
if response.status_code == 200:
helper.log_info(f"Successfully retrieved data from {url}")
else:
helper.log_error(f"Request failed. Status: {response.status_code}, Body: {response.text}")
event = helper.new_event(
data=response.text,
source=helper.get_input_type(),
index=helper.get_output_index(),
host="finesse1a",
sourcetype=helper.get_sourcetype()
)
ew.write_event(event)
except Exception as e:
helper.log_error(f"Error during request to {url}: {str(e)}")
Hello @spamarea1,
Did you run the test button before saving? If the output shows blank white screen, it'll not ingest any data. Also, try to add more loggers to isolate the problem. Also, for once, add a info log of the response.txt itself. So that you can understand what the output should look like.
Thanks,
Tejas.
I did the save and finish buttons. I get output when I hit the test and I see it when I search using the index and sourcetype. The data is even put into dashboard. I just have to run this manually.
Hey @spamarea1,
So, where do you see 0 events? On the sourcetype-extraction page of the Add-on Builder? Can you please share a screenshot of it?
I assume it is because of the nature of the data flow set up. Your Add-on Builder would be present on one of the Enterprise Servers and the data would be ingested into different server on which Indexer is residing. So, whenever the input runs, it collects the data and sends it to the indexer server.
If the indexing happens locally, you would be able to see the events on the Add-on Builder page. Let me know if what I'm understanding is incorrect and screenshot would be better to troubleshoot further.
Thanks,
Tejas.
---
If the above solution helps, an upvote is appreciated..!!
To get here I click apps > addon builder > add on list > data inputs. Then the list of scripts that I built are listed. If I hit edit, it goes through the entire configuration again, if I click on code, it goes to the script. All scripts run when I hit test and can be found via a search.
Hello @spamarea1 ,
If the server on which you are building the TA is not indexing locally, it will show 0 events only. If the server is acting as an indexer or is indexing locally, then only it'll show the events count. Hence, if you want to search the data, you'll have to log on to Search Head and search against the index to view the events.
Let me know if you were still not able to understand the concept.
Thanks,
Tejas.
---
If the above solution helps, an upvote is appreciated..!!