Splunk Python SDKm cannot get results from a query

dfofie — Fri, 12 Oct 2018 09:33:05 GMT

I'm using the latest Python SDK to send some requests to splunk, since i need to obtain those data from a script.
Somehow I'm unable to get the data, and the request is not failing, That says everything seems to be correctly working, but no results is returned.
I'm using exactly the same username/password combination as for the web login, sending the same request, From the web search, i get many thousands of results, but from the Python script, 0. This is the code snippet:

searchquery_normal = "search index=testing_cc_ps  sourcetype=doors_as"
kwargs_normalsearch = {"earliest_time": "@d",
                       "latest_time": "now",
                       "exec_mode": "blocking"}
job = splunk_service.jobs.create(searchquery_normal, **kwargs_normalsearch)

# A normal search returns the job's SID right away, so we need to poll for completion
while True:
    while not job.is_ready():
        print("Job is not ready")
        pass
    stats = {"isDone": job["isDone"],
             "doneProgress": float(job["doneProgress"]) * 100,
             "scanCount": int(job["scanCount"]),
             "eventCount": int(job["eventCount"]),
             "resultCount": int(job["resultCount"])}

    status = ("\r%(doneProgress)03.1f%%   %(scanCount)d scanned   "
              "%(eventCount)d matched   %(resultCount)d results") % stats

    sys.stdout.write(status)
    sys.stdout.flush()
    if stats["isDone"] == "1":
        sys.stdout.write("\n\nDone!\n\n")
        break
    sleep(2)

# Get the results and display them
for result in results.ResultsReader(job.results()):
    print(result)

job.cancel()
sys.stdout.write('\n')

That is the output

100.0% 0 scanned 0 matched 0 results
Done!

Re: Splunk Python SDKm cannot get results from a query

harsmarvania57 — Thu, 18 Oct 2018 12:30:48 GMT

Hi,

It looks like you are hitting same issue as explained in question https://answers.splunk.com/answers/691052/why-are-our-splunk-python-sdk-query-results-empty.html , try with sleep(5) after print("Job is not ready") line in while loop.

topic Re: Splunk Python SDKm cannot get results from a query in Splunk Dev

Splunk Python SDKm cannot get results from a query

Re: Splunk Python SDKm cannot get results from a query