No output from modular input_ta

[kkentsplunk]

I cant seem to get my modular input to write anything when I package, import, and run it. I have created a scripted input that works great. It queries some endpoints and write some formatted data to Splunk. I am trying to turn it into a modular input.

I am using modular input framework from @damien-dallimore. I package the app, load it, and get nothing. In my main do_run() it is using print to write out data but nothing appears in Splunk. I get no errors in splunkd, and no logging messages. The only thing i see in splunkd is:

10-23-2013 08:41:59.661 -0700 INFO ExecProcessor - Ran script: python "C:\Program Files\Splunk\etc\apps\Appname_ta\bin\Appname.py", took 17.01 seconds to run, 0 bytes read

I tried inserting some logging as shown here and even that doesn't show up.

if __name__ == '__main__':
logging.error("running the main thread")
if len(sys.argv) > 1:
if sys.argv[1] == "--scheme":
logging.error("scheme present, running scheme")

Any idea on what my next debugging step might be?

Thanks

[alacercogitatus · Accepted solution]

Try running this, replacing the $MI$ variable with the name of your modualar input:

splunk cmd splunkd print-modinput-config $MI$ $MI$://$YOUR_CONF_STANZA$ \
| splunk cmd python $SPLUNK_HOME/etc/apps/$YOUR_APP$/bin/$YOUR_APP$.py

[Damien_Dallimor]

Just to add.....

Is your logging level set to ERROR ?

logging.root.setLevel(logging.ERROR)

Also there is a also a "helloworld" example you can use and build out from : https://github.com/damiendallimore/SplunkModularInputsPythonFramework/tree/master/implementations/he...