Is it possible to have a separate log file for errors occurring only within a specific Splunk App?

[mariasudolska]

Hi all,

I am posting this question because I was not able to find the answer so far. I know that Splunk logs a lot about itself and that there are various log files in $SPLUNK_HOME/var/log/splunk. However, I would like to know whether it is possible to keep a separate log file that would contain only errors (and other messages) related to using a specific Splunk App, e.g. Search & Reporting or any custom developed App. Or in other words: when I develop a Splunk App, is it possible to specify something like an App error log?

If it is not possible at all, then the only option to search for errors would be to write specific searches for index=_internal and filter out the relevant information, is that right?

Thanks a lot.

[nickhills · Accepted solution]

Many Splunk apps write log lines into their own files for scripted/modular inputs, custom commands a lookups.
If your building your inputs in Python you can use the SDK to do the same
http://dev.splunk.com/view/logging/SP-CAAAFCN

[mariasudolska]

Many thanks for the answer.