Splunk custom alert Python issue

Question

I am running the following code (called caa_fiel_write.py) to output my splunk results to a JSON file:

import sys, json, urllib2
def write_file(settings):
        f = open('myfile','w')
        f.write("%s"%json.dumps(settings))
        f.close()
if __name__ == "__main__":
        caa_config = json.loads(sys.stdin.read())
        write_file(caa_config)

I get the following errors:

File "/opt/sdg/splunk/etc/apps/SDG/bin/caa_file_write.py", line 7, in caa_config = json.loads(sys.stdin.read())

File "/opt/sdg/splunk/lib/python2.7/json/__init__.py", line 339, in loads return _default_decoder.decode(s)

File "/opt/sdg/splunk/lib/python2.7/json/decoder.py", line 364, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end())

File "/opt/sdg/splunk/lib/python2.7/json/decoder.py", line 382, in raw_decode raise ValueError("No JSON object could be decoded")

ValueError: No JSON object could be decoded

Line 339 from __init__.py is:

   return _default_decoder.decode(s)

Lines 364 and 382 from decoder.py are:

    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
...
        raise ValueError("No JSON object could be decoded")

I am not sure why it is calling the decoder in the first place, it should be encoding. Both the __init__.py and decoder.py are standard Splunk python files which are available through any distribution.

What are these errors and how do I fix them?

Alex Hall Alex Hall · Accepted Answer · 2016-06-09T23:56:53

1

votes

json.loads(sys.stdin.read()) is decoding standard input. Your input is not valid JSON.

Splunk custom alert Python issue

1 Answers