Getting Data In

Why is setting up INFO Logging entries from custom modular inputs showing up as ERROR in splunkd?

Hi All,

So following the instructions here

formatter = logging.Formatter('%(levelname)s,myapp=1,%(message)s')
handler = logging.StreamHandler(stream=sys.stderr)

# Turn down requests from spamming Splunkd logs
logging.getLogger("requests").setLevel(logging.WARNING)"Started the Modular Input here")

This shows up in Splunkd as an ERROR in ExecProcessor

01-20-2017 15:01:46.147 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/myapp/bin/" INFO,myapp=1,Started the Modular Input here

As you can see the submessage is correctly marked as INFO however the parent loglevel for splunkd is ERROR.

Is there any way to get this to show up as INFO for the splunkd.log?

Showing up as ERROR for splunkd is not right at all.

I tried using sys.stdout but that broke the whole thing for obvious reasons.

 handler = logging.StreamHandler(stream=sys.stdout)
0 Karma


ERROR is the default if no level is specified, whap happens if you change your format do that instead of a comma immediately after levelname you put a space instead?

0 Karma

That resolves it for modular inputs thank you.

It doesn't appear to help with custom setup handlers though.

01-23-2017 08:12:45.396 +1000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/ setup':  INFO myapp=1,type=setup,starting
01-23-2017 08:12:44.788 +1000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/ setup':  INFO myapp=1,type=setup,starting

From this custom endpoint

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!