Splunk Dev

Why is there no ingestion of Splunk Object from Splunk Add-on Builder?

Krandark
Observer

I am currently working on an integration from a python scrip, collecting a JSON object, and parsing it to an event via the Splunk Add-on Builder however the object does not seem to appear within Splunk. 

From the Add-on Builder code, I have a loop that cycles round an array extracting objects to ingest as events:

 

for item in item_group:
  helper.log_warning(item)
  stat_time = int(time.time())
  event = helper.new_event(time=stat_time,source="Addon-Helper", index="testing", sourcetype="_json", data=json.dumps(item))
  ew.write_event(event)
  helper.log_warning(event)

 

 When I pull the extract from the log I get:

 

2022-03-08 10:43:56,350 WARNING pid=59367 tid=MainThread file=base_modinput.py:log_warning:302 | {'field_1': 'value_string', 'field_2': 'value_string', 'field_3': 'value_float', 'field_4': 'value_string', 'field_5': ['value_IP'], 'field_6': 'value_string', 'field_7': value_time, 'field_8': 'value_string', 'field_9': 'value_string'}

2022-03-08 10:43:56,351 WARNING pid=59367 tid=MainThread file=base_modinput.py:log_warning:302 | <splunklib.modularinput.event.Event object at 0x7f9072656250>

 

However, there is nothing added to the "testing" index, nor on wildcard search, nor on error searching for ingestion. 

In addition I have tried seeing the data field to a string, which still creates the object but Splunk does not seem to parse it:

 

event = helper.new_event(time=stat_time,source="Addon-Helper", index="testing", sourcetype="_json", data="Testing String")
ew.write_event(event)

 

This may simply be a staring too long at a problem kind of challenge and missing something basic but any help would be great. 

Labels (4)
Tags (4)
0 Karma
Get Updates on the Splunk Community!

Video | Welcome Back to Smartness, Pedro

Remember Splunk Community member, Pedro Borges? If you tuned into Episode 2 of our Smartness interview series, ...

Detector Best Practices: Static Thresholds

Introduction In observability monitoring, static thresholds are used to monitor fixed, known values within ...

Expert Tips from Splunk Education, Observability in Action, Plus More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...