It seems I have solved the problem. My output was in wrong format. This format works:
print "%s eventID=%s" % ("[" + strftime("%m/%d/%Y %H:%M:%S %p %Z",localtime()) + "]", int(time.time()))
But I have another question, how to make splunk read my custom formated event?
... View more