Splunk Dev

Python splunk submit event doesnt work correctly, event not found in splunk

kairat
New Member

When I try to add event string like = "37.31.31.31 - - [13/Dec/2015:23:08:40 +0100] ""POST /administrator/index.php HTTP/1.1"" 200 4494 ""http://almhuette-raith.at/administrator/"" ""Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0"" ""-"""

It ignores it, not throwing any errors.

When I send events like "HELLO", "THIS IS TEST" it works.

The code sample is here:

import splunklib.client as client
service = client.connect(
                        host=HOST,
                        port=PORT,
                        username=USERNAME,
                        password=PASSWORD)

myindex = service.indexes["main"]
myindex.submit(STRING, sourcetype="access_combined.log", host="local")

Version 2
with myindex.attached_socket(sourcetype='access_combined.log') as sock:
    sock.send(str.encode(STRING))
Tags (3)
0 Karma

kairat
New Member

I want to send an event using python-sdk.

Event's content "145.255.2.146 - - [2015-12-12:23:08:40 +0100] ""GET /administrator/ HTTP/1.1"" 200 4263 ""-"" ""Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0"" ""-"""

If we remove colons event will be sent, please, help me.

The code below doesn't show any mistake, neither add an event to splunk

import splunklib.client as client

service = client.connect(
                        host=HOST,
                        port=PORT,
                        username=USERNAME,
                        password=PASSWORD)
myindex = service.indexes["main"]
mysocket = myindex.attach(sourcetype='access_combined.log',host='local')
mysocket.send(str.encode('"145.255.2.146 - - [2015-12-12 +0100] ""GET /administrator/ HTTP/1.1"" 200 4263 ""-"" ""Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0"" ""-"""'))
mysocket.close()
0 Karma

starcher
Influencer

You are also better off sending data via HEC rather than directly via the API like this. Since you are in python already you can use a HEC class like https://github.com/georgestarcher/Splunk-Class-httpevent

0 Karma

kairat
New Member

Thanks for your answer, the problem is in ":" colons in event, it still doesn't work with the code your provided on github. I wonder if you can try it, in my case it ignores

"145.255.2.146 - - [2015-12-12*:22:21:00* +0100] ""GET /administrator/ HTTP/1.1"" 200 4263 ""-"" ""Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0"" ""-"""

PS: If I remove colons ":" it works as in using socket, and your code.

0 Karma

poete
Builder

Hello @kairat
,
did you try to escape the colons? I mean did you try to replace " with \" ?

0 Karma

kairat
New Member

It's OK with double quotes, the problem is about : When I removed colons(:), as in the comment provided with code, it works. I don't know why it's so.

0 Karma

poete
Builder

Hello @kairat,
I am confused. In the head of the post, you stated that with that code, you could not get the event added to Splunk, and now you say it works.
Anyway, the colons you removed changed the format of the date of the event, and the result format seems quite strange.
Can you please share the way you extract the date/time info for the sourcetype?

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...