topic Re: Python SDK Saved Search Variable Passing in Splunk Enterprise

Python SDK Saved Search Variable Passing

caden00 — Wed, 04 Aug 2021 16:18:45 GMT

I am using Python to access and saved search. I want to then run this saved search. I understand how to do this using the .dispatch method. The issue I am having is that I have a search with search variables, for example

| eval state="$state$"

Using SPL I simply call

| savedsearch "somesearch" state="state"

In Python I have seen with JS you can pass

{state: somestate}

in the .dispatch() method.

In Python however, any time I attempt to pass a parameter with these values I get various errors. Any help in the direction of passing a variable name would be great!

Thanks

Re: Python SDK Saved Search Variable Passing

kamlesh_vaghela — Wed, 04 Aug 2021 16:47:29 GMT

@caden00

Have you tried this?

kwargs = {"state": "state"} job = mysavedsearch.dispatch(**kwargs)

Re: Python SDK Saved Search Variable Passing

caden00 — Wed, 04 Aug 2021 17:16:15 GMT

Passing this returns that the value "state" is not supported by this handler.

Re: Python SDK Saved Search Variable Passing

kamlesh_vaghela — Thu, 05 Aug 2021 06:51:14 GMT

@caden00

Can you please try this?

kwargs = {"args.state": "state"} job = mysavedsearch.dispatch(**kwargs)