Splunk Search

Unable to index data to splunk using add-on builder modular input method though the event shows in output console

suryajagarapu
Explorer

Hi,
Event is successfully getting displayed on AOB output console but it is not getting indexed to splunk and it shows 0 events.

Here is the code:
import os
import sys
import time
import datetime
import requests
import json
import splunk
import random

def validate_input(helper, definition):
"""Implement your own validation logic to validate the input stanza configurations"""
pass

def collect_events(helper, ew):

# To create a splunk event
#myindex = service.indexes["test_index"]
data = str(random.randint(0,100))
event_data = {
     "info": data,
     "info2": data
     }
json_data = json.dumps(event_data)   

event = helper.new_event(index=helper.get_output_index(), sourcetype=helper.get_sourcetype(), data=json_data)
try:
     ew.write_event(event)
except Exception as e:
     raise e
Tags (1)

suryajagarapu
Explorer

I am trying this one on windows machine. Please let me know if anyone could help on this? One more thing I observed, i set the collect interval as 30 secs in data input section to trigger the script but it's not happening and displays output on console every time I click on test button.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...