Hi All,
So following the instructions here
https://docs.splunk.com/Documentation/Splunk/6.5.1/AdvancedDev/ModInputsLog
logging.root
logging.root.setLevel(logging.DEBUG)
formatter = logging.Formatter('%(levelname)s,myapp=1,%(message)s')
handler = logging.StreamHandler(stream=sys.stderr)
handler.setFormatter(formatter)
logging.root.addHandler(handler)
# Turn down requests from spamming Splunkd logs
logging.getLogger("requests").setLevel(logging.WARNING)
logging.info("Started the Modular Input here")
This shows up in Splunkd as an ERROR in ExecProcessor
01-20-2017 15:01:46.147 +1000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/myapp/bin/json_api.py" INFO,myapp=1,Started the Modular Input here
As you can see the submessage is correctly marked as INFO however the parent loglevel for splunkd is ERROR.
Is there any way to get this to show up as INFO for the splunkd.log?
Showing up as ERROR for splunkd is not right at all.
I tried using sys.stdout but that broke the whole thing for obvious reasons.
handler = logging.StreamHandler(stream=sys.stdout)
ERROR is the default if no level is specified, whap happens if you change your format do that instead of a comma immediately after levelname you put a space instead?
That resolves it for modular inputs thank you.
It doesn't appear to help with custom setup handlers though.
01-23-2017 08:12:45.396 +1000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py setup': INFO myapp=1,type=setup,starting
01-23-2017 08:12:44.788 +1000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/bin/runScript.py setup': INFO myapp=1,type=setup,starting
From this custom endpoint
http://pastebin.com/2zMM8sak