sys.stderr Not logging to splunkd

I think I can clear this up for you. Standard error (stderr) gets logged to the _internal index ONLY for scripted inputs--which are used to feed some kind of custom data into Splunk. It sounds like you are creating a custom search script, which is the mechanism used to inject custom code/logic into a search. (There are also external lookup commands which can also be python scripts, and alert triggered scripts which can also be written in Python.) These are all used for different situations, but yet do share some fairly common themes. But I'll not go into all of that now....

If you are trying to create a custom search command, then the easiest approach I'd suggest adding the following code to the top of your python script:

import logging as logger
logger.basicConfig(level=logger.INFO, format='%(asctime)s %(levelname)s %(message)s',
    filename=os.path.join(os.environ['SPLUNK_HOME'],'var','log','splunk','NameOfMyCustomSearchScript.log'),
    filemode='a')

(You can also use "python.log" if you want, there's nothing stopping you; but you may want to make sure that you use the same format string as the other processes that write to that log.)

Then simply change any sys.stderr.write() calls to logger.info() or logger.error() or whatever severity you want.

Hope that helps.