Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Why does my modular input Run() command generate thousands of events (rather than dozens)?

$
0
0
I have a question about some odd behavior I'm seeing in my Modular Input app; specifically: [https://github.com/Qumulo/qumulo_splunk_app/blob/master/bin/qumulo.py#L296-L321][1] There is a bug here, but when I fix the bug, things don't work :). The bug is: After I process the endpoint (can be one of iops, capacity or throughput) I call continue, which repeats the while True loop from the top. So time.sleep(polling_interval) never gets called, and I end up creating thousands of events and thrashing our REST API where I should be creating only dozens of events. But when I remove the continue after endpoint handling, I get no events in Splunk at all, and I cannot understand why. What's more: if I place something simple like time.sleep(10) before I process any endpoints, I don't get any logged events either. So there's something in my module input run() function that I'm not understanding -- how it is invoked or what is permissible inside of the run() function. I think it follows the python Twitter example structurally, but I'm not sure how run() is invoked, now often and so forth. Any ideas? Thanks in advance - Michael [1]: https://github.com/Qumulo/qumulo_splunk_app/blob/master/bin/qumulo.py#L296-L321

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>