Splunk Search

Unable to index data to splunk using add-on builder modular input method though the event shows in output console

suryajagarapu
Explorer

Hi,
Event is successfully getting displayed on AOB output console but it is not getting indexed to splunk and it shows 0 events.

Here is the code:
import os
import sys
import time
import datetime
import requests
import json
import splunk
import random

def validate_input(helper, definition):
"""Implement your own validation logic to validate the input stanza configurations"""
pass

def collect_events(helper, ew):

# To create a splunk event
#myindex = service.indexes["test_index"]
data = str(random.randint(0,100))
event_data = {
     "info": data,
     "info2": data
     }
json_data = json.dumps(event_data)   

event = helper.new_event(index=helper.get_output_index(), sourcetype=helper.get_sourcetype(), data=json_data)
try:
     ew.write_event(event)
except Exception as e:
     raise e
Tags (1)

suryajagarapu
Explorer

I am trying this one on windows machine. Please let me know if anyone could help on this? One more thing I observed, i set the collect interval as 30 secs in data input section to trigger the script but it's not happening and displays output on console every time I click on test button.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...