topic Re: Is it possible to provide event sampling in splunk SDK call? in Splunk Dev

Is it possible to provide event sampling in splunk SDK call?

ashiqm — Fri, 01 Dec 2017 09:15:11 GMT

I tried to pass sampleRatio parameter in JobsArgs, but no luck. Is there any way to set sampling ratio in Splunk job?

damien_chillet — Fri, 01 Dec 2017 13:58:09 GMT

I managed to have it working with parameter "sample_ratio" and python SDK.

Code sample below for 1:10 ratio:

job = instance.jobs.create("search index=_internal component=* earliest=-1d@d", **{ "sample_ratio": 10})

ashiqm — Sat, 02 Dec 2017 07:01:47 GMT

Hi Damien,

Thanks for your reply...

In this case, I can't supply the arguments, right?

my current code is something like this job = splunk.getJobs().create(query, jobArgs);

I have some arguments like timeOut. Any idea?

damien_chillet — Mon, 04 Dec 2017 09:54:44 GMT

Hi ashiqm,

Unfortunately I don't work with the Java SDK.
Apparently there is no existing setter method for sample_ratio, so you would have to write your own.

May be worth it to re-ask your question specifying you are using Java SDK so Java SDK users get visibility on your question.