All Apps and Add-ons

Modular input using my Python library is not working an am stuck. Ideas on how to debug?

michaelQumulo
Explorer

Hello

I'm trying to create a modular input for Splunk for our product, Qumulo clusters (qumulo.com/products/qumulo-core/). We have a REST API that exposes data about our storage clusters and some of our customers want to explore and manage information about their clusters using Splunk.

I've created (with Damien Dallimore's help) a first version of a modular input which you can see here (it is public and on GitHub):

github.com/Qumulo/qumulo_splunk

It loads into Splunk Enterprise with no problems/errors/warnings, but I see no data for my modular input or Wcript in splunk (my script is $SPLUNK_HOME/etc/apps/qumulo_app/bin/qumulo.py on my machine).

I ran

../../bin/splunk cmd python qumulo_app/bin/qumulo.py —scheme

and the scheme looks OK to me (from a naive perspective at least -- no errors) and when I run a Splunk search like this:

index=_internal ExecProcessor error qumulo.py

I don't see any meaningful results. I've added some logging.error debug messages to my script too... where do those messages get logged? Not seeing those either.

So I'm a bit stuck. Any pointers welcome. If there are other support channels I should try, pls mention that too (I'm new to Splunk integration, obviously ;)).

Thanks - Michael Murray / mmurray@qumulo.com

0 Karma
1 Solution

snowmizer
SplunkTrust
SplunkTrust

This command came from a presentation that was given at .Conf last week. It may help you testing....modify to fit your module names.

splunk cmd splunkd print-­‐modinput-­‐config

| $SPLUNK_HOME/bin/splunk cmd python

View solution in original post

0 Karma

michaelQumulo
Explorer

Problems solved, thanks for help. Our modular input app is now available:

https://github.com/Qumulo/qumulo_splunk_app

Also via Splunkbase.

0 Karma

snowmizer
SplunkTrust
SplunkTrust

This command came from a presentation that was given at .Conf last week. It may help you testing....modify to fit your module names.

splunk cmd splunkd print-­‐modinput-­‐config

| $SPLUNK_HOME/bin/splunk cmd python

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...