Splunk Dev

sys.stderr Not logging to splunkd

Drainy
Champion

Following on from http://splunk-base.splunk.com/answers/30462/best-practice-logging-script-runtime-results I have been having difficulties implementing a suggestion.

Quick summary, I am building a custom search but I keep enountering problems along the way. At the moment I am trying to log issues as I go along but I cannot get any logging import or sys.stderr to work. Logging outputs nothing to python.log (permissions are all fine) and using stderr isn't outputting anything to splunkd.log, even when the script is working and running through from start to finish.

I would appreciate any ideas as I cannot get my head around what is going on with it, I just need some feedback to find other problems!

1 Solution

Lowell
Super Champion

I think I can clear this up for you. Standard error (stderr) gets logged to the _internal index ONLY for scripted inputs--which are used to feed some kind of custom data into Splunk. It sounds like you are creating a custom search script, which is the mechanism used to inject custom code/logic into a search. (There are also external lookup commands which can also be python scripts, and alert triggered scripts which can also be written in Python.) These are all used for different situations, but yet do share some fairly common themes. But I'll not go into all of that now....

If you are trying to create a custom search command, then the easiest approach I'd suggest adding the following code to the top of your python script:

import logging as logger
logger.basicConfig(level=logger.INFO, format='%(asctime)s %(levelname)s %(message)s',
    filename=os.path.join(os.environ['SPLUNK_HOME'],'var','log','splunk','NameOfMyCustomSearchScript.log'),
    filemode='a')

(You can also use "python.log" if you want, there's nothing stopping you; but you may want to make sure that you use the same format string as the other processes that write to that log.)

Then simply change any sys.stderr.write() calls to logger.info() or logger.error() or whatever severity you want.

Hope that helps.

View solution in original post

Lowell
Super Champion

I think I can clear this up for you. Standard error (stderr) gets logged to the _internal index ONLY for scripted inputs--which are used to feed some kind of custom data into Splunk. It sounds like you are creating a custom search script, which is the mechanism used to inject custom code/logic into a search. (There are also external lookup commands which can also be python scripts, and alert triggered scripts which can also be written in Python.) These are all used for different situations, but yet do share some fairly common themes. But I'll not go into all of that now....

If you are trying to create a custom search command, then the easiest approach I'd suggest adding the following code to the top of your python script:

import logging as logger
logger.basicConfig(level=logger.INFO, format='%(asctime)s %(levelname)s %(message)s',
    filename=os.path.join(os.environ['SPLUNK_HOME'],'var','log','splunk','NameOfMyCustomSearchScript.log'),
    filemode='a')

(You can also use "python.log" if you want, there's nothing stopping you; but you may want to make sure that you use the same format string as the other processes that write to that log.)

Then simply change any sys.stderr.write() calls to logger.info() or logger.error() or whatever severity you want.

Hope that helps.

christopherwern
New Member

Hello Lowell,

thank you for that proposal. I tried that aswell, but it wont work for my script.
It just skips the logging part in my script without displaying any error.

Maybe you can help me out of this?

Kind regards,
Christopher

0 Karma

Drainy
Champion

Thanks! That clears that up, I think I made assumptions along the way that anything python was handled by the interpreter in the same way so I didn't clearly specify between if I was doing custom searches or scripts. I will try this tomorrow but it certainly explains my results

0 Karma
Get Updates on the Splunk Community!

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...