I am working on a python script to upload logs to an index on the local Splunk server. I use splunk-sdk for python for this.
Connection and some splunk-sdk example runs fine but I am having trouble when uploading logs.
When i run the upload.py script with the file to be uploaded command runs with no error but I don't see the logs on any index. So far I tried:
1. using the example script on github python-sdk page 2. implementing upload() method with indexes class described here: https://docs.splunk.com/DocumentationStatic/PythonSDK/1.6.5/client.html#splunklib.client.Index.uploa... 3. Implementing oneshot() method with inputs class
None of the above worked.
What am i doing wrong? Is there any way to have some feedback on why the file wasn't uploaded?
You would be much better off sending the logs in via HTTP Event Collector (HEC) if you are already operating in python. Read the file, blow in the events.
Not sure why it doesn't work. I use python to upload data from a file to an index on my local Splunk. This is what I did
1. I installed splunk-sdk for python. Installed simply using the pip install command so:
pip install splunk-sdk
2. On python, you need to first connect to your local Splunk server
"""Connect to splunk local""" import splunklib.client as client import splunklib.results as results from splunklib.binding import AuthenticationError HOST=localhost PORT = '8089' USERNAME = 'username' PASSWORD = 'password' try: service = client.connect(host=HOST, port=PORT, username=USERNAME, password=PASSWORD) except exception as e: print(str(e))
3. Upload your file to your index
myindex = service.indexes[ENTER INDEX NAME] # Retrieve the index for the data try: myindex.upload(ENTER THE ABSOLUTE PATH TO YOUR FILE) # Upload file to the index specified except Exception as e: print(str(e))