Install & Compatibility
Where this runs
tested against v3.0.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.95 runs
installs and imports cleanly · install 0.0s · import 0.366s · 21.1MB
glibcpy 3.10–3.95 runs
installs and imports cleanly · install 2.2s · import 0.332s · 22MB
19MB installed
● package 19MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
SplunkHandler
✓ from splunk_handler import SplunkHandler
force_flush
✓ from splunk_handler import force_flush
Specifically needed for environments like AWS Lambda to ensure logs are flushed before process termination.
This quickstart demonstrates how to configure and use `splunk-handler` to send log messages to Splunk Enterprise via the HTTP Event Collector. It uses environment variables for sensitive connection details and includes an example of `force_flush` for critical environments like AWS Lambda. Ensure your Splunk HEC is properly configured and accessible from where this code runs.
import logging
import os
from splunk_handler import SplunkHandler, force_flush
# Configure Splunk HEC details via environment variables
SPLUNK_HOST = os.environ.get('SPLUNK_HOST', 'splunk.example.com')
SPLUNK_PORT = os.environ.get('SPLUNK_PORT', '8088')
SPLUNK_TOKEN = os.environ.get('SPLUNK_TOKEN', 'YOUR_SPLUNK_HEC_TOKEN')
SPLUNK_INDEX = os.environ.get('SPLUNK_INDEX', 'main')
# Initialize the SplunkHandler
try:
splunk_handler = SplunkHandler(
host=SPLUNK_HOST,
port=SPLUNK_PORT,
token=SPLUNK_TOKEN,
index=SPLUNK_INDEX,
protocol='https', # Use 'http' if SSL is not configured
verify=True, # Set to False if using self-signed certs and not providing CA
flush_interval=1.0 # Send logs every 1 second for demonstration
)
# Add the handler to the root logger
logging.getLogger('').addHandler(splunk_handler)
logging.getLogger('').setLevel(logging.INFO)
# Example log messages
logging.info('Hello from splunk-handler!')
logging.warning('This is a warning message.')
logging.error('An error occurred: %s', 'something went wrong')
# For environments like AWS Lambda, ensure logs are flushed before exiting.
# In a typical application, the atexit hook handles this, but explicit call might be needed.
force_flush()
print('Logs sent to Splunk (check your Splunk instance).')
except Exception as e:
print(f"Failed to configure Splunk handler or send logs: {e}")
print("Please ensure SPLUNK_HOST, SPLUNK_PORT, SPLUNK_TOKEN, and SPLUNK_INDEX are correctly set.")
print("Also, verify that Splunk HEC is enabled and accessible.")
Errors
Common errors & fixes
ModuleNotFoundError: No module named 'splunk_handler'
The `splunk-handler` package has not been installed in the current Python environment.
fixpip install splunk-handler
requests.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed
The Python environment cannot verify the SSL certificate presented by the Splunk HEC endpoint, often due to self-signed certificates or missing root CAs.
fixSet `verify=False` in the `SplunkHandler` configuration (not recommended for production) or provide the path to a custom CA bundle using the `ca_certs` parameter: `SplunkHandler(..., verify=True, ca_certs='/path/to/your/ca_bundle.pem')`.
requests.exceptions.ConnectionError: Failed to establish a new connection: [Errno 111] Connection refused
The `splunk-handler` cannot establish a network connection to the specified Splunk HEC endpoint, possibly due to an incorrect host/port, firewall rules, or the Splunk instance being down.
fixVerify the `host` and `port` configured for `SplunkHandler`, check network connectivity to the Splunk server (e.g., using `ping` or `telnet`), and ensure Splunk's HEC is enabled and listening.
Failed to send event to Splunk: HTTP Error 401: Unauthorized
The Splunk HEC token provided to `SplunkHandler` is incorrect, expired, or lacks the necessary permissions to send data to the specified index.
fixVerify the HEC `token` in your `SplunkHandler` configuration against your Splunk HEC setup, and ensure it is valid and has appropriate write access to the specified index in Splunk.
Upgrade
Version history
3.0.0latest on PyPI · released Aug 17, 2021
Audit
Dependencies
requestsrequiredUsed for making HTTP requests to the Splunk HTTP Event Collector.