Splunk Search

Unable to index data to splunk using add-on builder modular input method though the event shows in output console

suryajagarapu
Explorer

Hi,
Event is successfully getting displayed on AOB output console but it is not getting indexed to splunk and it shows 0 events.

Here is the code:
import os
import sys
import time
import datetime
import requests
import json
import splunk
import random

def validate_input(helper, definition):
"""Implement your own validation logic to validate the input stanza configurations"""
pass

def collect_events(helper, ew):

# To create a splunk event
#myindex = service.indexes["test_index"]
data = str(random.randint(0,100))
event_data = {
     "info": data,
     "info2": data
     }
json_data = json.dumps(event_data)   

event = helper.new_event(index=helper.get_output_index(), sourcetype=helper.get_sourcetype(), data=json_data)
try:
     ew.write_event(event)
except Exception as e:
     raise e
Tags (1)

suryajagarapu
Explorer

I am trying this one on windows machine. Please let me know if anyone could help on this? One more thing I observed, i set the collect interval as 30 secs in data input section to trigger the script but it's not happening and displays output on console every time I click on test button.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...