Splunk Search

Unable to index data to splunk using add-on builder modular input method though the event shows in output console

suryajagarapu
Explorer

Hi,
Event is successfully getting displayed on AOB output console but it is not getting indexed to splunk and it shows 0 events.

Here is the code:
import os
import sys
import time
import datetime
import requests
import json
import splunk
import random

def validate_input(helper, definition):
"""Implement your own validation logic to validate the input stanza configurations"""
pass

def collect_events(helper, ew):

# To create a splunk event
#myindex = service.indexes["test_index"]
data = str(random.randint(0,100))
event_data = {
     "info": data,
     "info2": data
     }
json_data = json.dumps(event_data)   

event = helper.new_event(index=helper.get_output_index(), sourcetype=helper.get_sourcetype(), data=json_data)
try:
     ew.write_event(event)
except Exception as e:
     raise e
Tags (1)

suryajagarapu
Explorer

I am trying this one on windows machine. Please let me know if anyone could help on this? One more thing I observed, i set the collect interval as 30 secs in data input section to trigger the script but it's not happening and displays output on console every time I click on test button.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...