So following the instructions here
logging.root logging.root.setLevel(logging.DEBUG) formatter = logging.Formatter('%(levelname)s,myapp=1,%(message)s') handler = logging.StreamHandler(stream=sys.stderr) handler.setFormatter(formatter) logging.root.addHandler(handler) # Turn down requests from spamming Splunkd logs logging.getLogger("requests").setLevel(logging.WARNING) logging.info("Started the Modular Input here")
This shows up in Splunkd as an ERROR in ExecProcessor
01-20-2017 15:01:46.147 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/myapp/bin/json_api.py" INFO,myapp=1,Started the Modular Input here
As you can see the submessage is correctly marked as INFO however the parent loglevel for splunkd is ERROR.
Is there any way to get this to show up as INFO for the splunkd.log?
Showing up as ERROR for splunkd is not right at all.
I tried using sys.stdout but that broke the whole thing for obvious reasons.
handler = logging.StreamHandler(stream=sys.stdout)
That resolves it for modular inputs thank you.
It doesn't appear to help with custom setup handlers though.
01-23-2017 08:12:45.396 +1000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py setup': INFO myapp=1,type=setup,starting 01-23-2017 08:12:44.788 +1000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py setup': INFO myapp=1,type=setup,starting
From this custom endpoint