Return Salt Job Results to a JSON File

file_return.py

from __future__ import absolute_import

# Import Standard Libs
import logging
import json
import os

# Import Salt Libs
import salt.returners

log = logging.getLogger(__name__)

# Define the module's virtual name
__virtualname__ = 'file'


def __virtual__():
    return __virtualname__


def _get_options(ret):
    '''
    Returns options used for the file returner.
    '''
    attrs = {'directory': 'directory'}
    _options = salt.returners.get_returner_options('returner.{0}'.format(__virtualname__),
                                                   ret,
                                                   attrs,
                                                   __salt__=__salt__)
    return _options


def returner(ret):
    '''
    Return information to a json file
    '''
    opts = _get_options(ret)
    directory = opts.get('directory')

    log.debug('file_returner_options: {0}'.format(opts))

    if not directory:
        log.error('file_returner: returner.file.directory parameter not ' \
                  'specified in the minion or master configuration!')

    if not os.path.exists(directory):
        os.makedirs(directory)

    with open(os.path.join(directory, '{0}.json'.format(ret['jid'])), 'w') as outfile:
        json.dump(ret, outfile)
    return

inputs.conf

[monitor:///var/log/salt/returner/*.json]
disabled = false
index = main
sourcetype = salt:returner
recursive = false

props.conf

[salt:returner]
KV_MODE = JSON

Inputs.conf, and props.conf are splunkforwarder settings files. Inputs.conf tells splunk to index the returner JSON files. Props.conf tells splunk to treat the file as a JSON where it will perform automatic field extractions based on Key Values. These settings files should be located on the same instance where the returners are stored.