Splunk custom alert Python issue

Question

I am running the following code (called caa_fiel_write.py) to output my splunk results to a JSON file:

import sys, json, urllib2
def write_file(settings):
        f = open('myfile','w')
        f.write("%s"%json.dumps(settings))
        f.close()
if __name__ == "__main__":
        caa_config = json.loads(sys.stdin.read())
        write_file(caa_config)

I get the following errors:

File "/opt/sdg/splunk/etc/apps/SDG/bin/caa_file_write.py", line 7, in caa_config = json.loads(sys.stdin.read())

File "/opt/sdg/splunk/lib/python2.7/json/__init__.py", line 339, in loads return _default_decoder.decode(s)

File "/opt/sdg/splunk/lib/python2.7/json/decoder.py", line 364, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end())

File "/opt/sdg/splunk/lib/python2.7/json/decoder.py", line 382, in raw_decode raise ValueError("No JSON object could be decoded")

ValueError: No JSON object could be decoded

Line 339 from __init__.py is:

   return _default_decoder.decode(s)

Lines 364 and 382 from decoder.py are:

    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
...
        raise ValueError("No JSON object could be decoded")

I am not sure why it is calling the decoder in the first place, it should be encoding. Both the __init__.py and decoder.py are standard Splunk python files which are available through any distribution.

What are these errors and how do I fix them?

Alex Hall · Accepted Answer · 2016-06-09 23:56:53Z

2

json.loads(sys.stdin.read()) is decoding standard input. Your input is not valid JSON.

answered Jun 9, 2016 at 23:56

Alex Hall

36.2k5 gold badges63 silver badges98 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Deesbek Over a year ago

so the input has to be valid JSON?

Alex Hall Over a year ago

@Deesbek yes, what did you expect?

Deesbek Over a year ago

LOL, I was expecting a conversion, standard key/value pairs to JSON, but now that I actually re-read the chapter in the book it is behaving as expected.

Collectives™ on Stack Overflow

Splunk custom alert Python issue

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related