Splunk Dev

Why does Splunk scripted input not print data when script is turned off?

sumeet
Engager

Hello,

I am using python script to read from remote api with pagination. I have one problem while reading data from api, once i started script and it pulls data after that if i disable the script the data does not get printed in splunk though it has passed through print statement.

isoutamo
SplunkTrust
SplunkTrust
Maybe I don' understand this right, but when you have disabled input then splunk don't run that script until you are reenabling that input.

sumeet
Engager

Hi @isoutamo 


In the below method we are looping through data and sending each event to splunk(for indexing) using print method. So while executing this method if we disable script through ui, it does not index any event to splunk and program is immediately terminated. 

For example: We have 5 events to be indexed. So the for loop should execute print 5 times. Now, suppose it has executed it 2 times and now we disable the script through UI. Then the script will be terminated immediately and the two events which were sent using print function will also not be indexed.

Is it expected behaviour and how we could handle such cases gracefully?


My code is like this:

 

def stream_to_splunk(self, data):
        for event in data:
            jsonData = json.dumps({"sourceType": self.sourceType, "event": event})
            print(jsonData)
            

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

I cannot recall how this has implemented, but my gut feelings is that this is how it has planned to working. I think that there is some buffering on sending events to splunk and when you are "stopping" it before it has finished it don't sent any events as it has just terminated and all buffers are cleared.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...