Python SDK saved_search.py action options are unclear

vwilson — Tue, 29 Sep 2020 07:48:16 GMT

I'm trying to get familiar with Splunk's Python SDK via the provided examples. However, I'm struggling to understand the format expected for actions when creating saved searches.

$ ./saved_search.py --operation=create --name=api_test_email --search="unique" --actions=email --action.email.to="user@example.org" --action.email.sender="splunkbot"

Usage: saved_search.py --help for options

saved_search.py: error: no such option: --action.email.to

The help states:

"action...": {
'flags': ["--action.."],
'help': " A key/value pair that is specific to the action_type. For example, if actions contains email, then the following keys would be necessary: action.email.to=foo@splunk.com and action.email.sender=splunkbot. For scripts: action.script.filename=doodle.py (note: script is run from $SPLUNK_HOME/bin/scripts/)"

Re: Python SDK saved_search.py action options are unclear

jkat54 — Tue, 29 Dec 2015 02:30:09 GMT

Did you copy and paste the command from a word document into linux command line or something?

The command looks good. I suggest you type the command manually and see if it resolves the issue.

topic Python SDK saved_search.py action options are unclear in Splunk Dev

Python SDK saved_search.py action options are unclear

Re: Python SDK saved_search.py action options are unclear