Splunk Search

How to configure logging from a custom search command to the search.log Splunk Web using the Splunk Python SDK?

johannesschilli
Engager

Hi,

I'm writing a search command and need to log events from it to Splunk Web. I'm using the Python SDK in the current version 1.5.0. I already looked into answer 80712 and could not find any other concerned with logging.

I'm looking for the correct configuration of the logger already included in the SearchCommand base Class, so that I can do something like this:

class MySearchCommand(GeneratingCommand):
    def generate(self):
        self.logger.info('my message')

So that 'my message' will be shown in the log after clicking Job -> Inspect Job -> search.log

Thanks a lot
Johannes

0 Karma

DUThibault
Contributor

Your problem may be the default logging level, which is ERROR. In order for your self.logger.info and self.logger.debug invocations to make it to the /opt/splunk/var/run/splunk/dispatch/.../search.log of the job, you must either globally reduce the logging level, or reduce it for the appropriate channel (Settings: Server Settings: Server Logging or /opt/splunk/etc/log.cfg, if you can identify the pertinent channel---I certainly can't), or issue self.logger.logging_level = 'DEBUG' in your command's generate method (or equivalent; generate is for GeneratingCommand subclasses).

0 Karma

gwobben
Communicator

Have you actually tried this? I have this line in my code and it's working fine:

def generate(self):
...
    self.logger.fatal("This is a test")
...

search.log:

[Some timestamp] ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\[...]\helloworld.py __EXECUTE__ [...]:  This is a test
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...