Splunk Dev

How to display validation message for custom modular input?

yr0
New Member

Hi,

I've created the modular input for Splunk 6.6.0 and indicated within the scheme that the input should use external validation.
When I submit new instance of my input, the validation gets invoked, and if it fails, the interface displays the error Encountered the following error while trying to save: Validation for scheme=(input name) failed: The script returned with exit status 1.

Could you suggest how to display the actual error message (thrown by script) instead of this one? I've tried logging the error, writing it with EventWriter instance, wrapping it in XML <error><message></message></error>, printing it to stdout and stderr.

Lastly, I tried creating a custom interface manager, however I'm not sure how to execute validation at server side when user presses 'Next' and display the error.

I'm using Python SDK (1.6.2)

Any help would be much appreciated.

0 Karma

yr0
New Member

I ended up writing custom interface for my app, which included custom controller actions that returned readable errors for validation.
Kudos to Luke Murphey, whose Splunk Web Input really helped me understand how to write custom UI for the app.

I think external validation is useless if you can't tell the user what is the reason of failure. This seems like a huge design overlook for modular inputs. On the other hand, it's great that Splunk allows to tune the user interface to your needs - even though there is hardly any documentation on how to do it.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...