I have a question about some odd behavior I'm seeing in my Modular Input app; specifically:
[https://github.com/Qumulo/qumulo_splunk_app/blob/master/bin/qumulo.py#L296-L321][1]
There is a bug here, but when I fix the bug, things don't work :).
The bug is: After I process the endpoint (can be one of iops, capacity or throughput) I call continue, which repeats the while True loop from the top. So time.sleep(polling_interval) never gets called, and I end up creating thousands of events and thrashing our REST API where I should be creating only dozens of events.
But when I remove the continue after endpoint handling, I get no events in Splunk at all, and I cannot understand why. What's more: if I place something simple like time.sleep(10) before I process any endpoints, I don't get any logged events either.
So there's something in my module input run() function that I'm not understanding -- how it is invoked or what is permissible inside of the run() function. I think it follows the python Twitter example structurally, but I'm not sure how run() is invoked, now often and so forth.
Any ideas?
Thanks in advance - Michael
[1]: https://github.com/Qumulo/qumulo_splunk_app/blob/master/bin/qumulo.py#L296-L321
↧