Set up logging
Well-behaved scripts send logging data to
splunkd.log. This logging data is useful for tracking and troubleshooting.
Any data you write to stderr is written to
splunkd.log. You can specify a log level when writing to stderr. If you do not specify a log level, the default log level is ERROR. The following example shows how to write INFO and ERROR logging entries:
INFO Connecting to the endpoint ERROR Unable to connect to the endpoint
Here are the recognized log levels from lowest to highest severity:
Log entries are written to
splunkd.log based on the log level. By default, entries with a log level of INFO or higher are written to
splunkd.log. To modify the default behavior, in Splunk Web navigate to Settings > Server settings > Server logging. Then navigate to the ExecProcessor log channel. Select ExecProcessor to make any changes.
Alternatively, you can navigate to the following file:
log.cfg, set the logging level for modular inputs by editing the log level in the following line:
For more information on logging, refer to What Splunk logs about itself in the Troubleshooting Manual.
Note: You must have Splunk Enterprise admin privileges to change logging behavior.
Example: Setting up standard Splunk logging
The following snippet from a script shows how to set up standard Splunk logging.
. . . import logging . . . # set up logging suitable for splunkd consumption logging.root logging.root.setLevel(logging.DEBUG) formatter = logging.Formatter('%(levelname)s %(message)s') handler = logging.StreamHandler(stream=sys.stderr) handler.setFormatter(formatter) logging.root.addHandler(handler) . . . # add various logging statements # for example: # # logging.info("URL %s already processed. Skipping.") # # if item_node: # logging.debug("XML: found item") # # etc.
Create modular inputs
Set up external validation
This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15