Hello,
I play with Python API Modular input:
import splunk.input as input
(...)
input.submit(event, hostname = socket.gethostname(), sourcetype = 'incident_change', source = 'incident_settings.py', index = config['index'])
When I add to event some regional characters, events are truncated in some next bytes.
They look like:
> time=2017-12-19T11:25:30.793847 severity=INFO origin="incident_posture" event_id="fc3cdeaed38b9b1d14954093007aa5ad" user="admin" action="change" incident_id="045a0f24-6e2e-48f9-81b6-6fdb586ff08a" department="Bezpieczeństwo teleinformatyczne, Bezpieczeństwo biznesowe, Bezpieczeństwo fizyczne, Bezpieczeństwo informacji" previous_department="Bezpieczeństwo teleinformaty
I inspected a value of 'event' parameter passed to input.submit, and it is OK.
I also inspected the indexer props, and they are correct.
What can I do more?
↧