<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic When using the Python-SDK, why is Splunk silently returning nothing for some indices? in Splunk Dev</title>
    <link>https://community.splunk.com/t5/Splunk-Dev/When-using-the-Python-SDK-why-is-Splunk-silently-returning/m-p/446399#M8095</link>
    <description>&lt;P&gt;I'm trying to use the Python SDK to search in Splunk.&lt;/P&gt;

&lt;P&gt;However, I can only search on some indices, for others I just get an empty response.&lt;/P&gt;

&lt;P&gt;For example, when I use the command&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;search index=trace
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I get a response, but when I use &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;search index=read
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I don't get any response. But if I use the web interface this query works, i.e. my user has rights to search on that index and I am authenticating myself when using the Python-SDK.&lt;/P&gt;

&lt;P&gt;Do you have any idea what could explain this? The silent returning of nothing is not helping me.&lt;/P&gt;</description>
    <pubDate>Thu, 13 Dec 2018 15:13:51 GMT</pubDate>
    <dc:creator>haffi112</dc:creator>
    <dc:date>2018-12-13T15:13:51Z</dc:date>
    <item>
      <title>When using the Python-SDK, why is Splunk silently returning nothing for some indices?</title>
      <link>https://community.splunk.com/t5/Splunk-Dev/When-using-the-Python-SDK-why-is-Splunk-silently-returning/m-p/446399#M8095</link>
      <description>&lt;P&gt;I'm trying to use the Python SDK to search in Splunk.&lt;/P&gt;

&lt;P&gt;However, I can only search on some indices, for others I just get an empty response.&lt;/P&gt;

&lt;P&gt;For example, when I use the command&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;search index=trace
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I get a response, but when I use &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;search index=read
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I don't get any response. But if I use the web interface this query works, i.e. my user has rights to search on that index and I am authenticating myself when using the Python-SDK.&lt;/P&gt;

&lt;P&gt;Do you have any idea what could explain this? The silent returning of nothing is not helping me.&lt;/P&gt;</description>
      <pubDate>Thu, 13 Dec 2018 15:13:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Dev/When-using-the-Python-SDK-why-is-Splunk-silently-returning/m-p/446399#M8095</guid>
      <dc:creator>haffi112</dc:creator>
      <dc:date>2018-12-13T15:13:51Z</dc:date>
    </item>
    <item>
      <title>Re: When using the Python-SDK, why is Splunk silently returning nothing for some indices?</title>
      <link>https://community.splunk.com/t5/Splunk-Dev/When-using-the-Python-SDK-why-is-Splunk-silently-returning/m-p/446400#M8096</link>
      <description>&lt;P&gt;I have confirmed with an administrator that it is not a problem with access rights as the script shows the same behavior when he authenticates with his user.&lt;/P&gt;</description>
      <pubDate>Fri, 14 Dec 2018 14:36:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Dev/When-using-the-Python-SDK-why-is-Splunk-silently-returning/m-p/446400#M8096</guid>
      <dc:creator>haffi112</dc:creator>
      <dc:date>2018-12-14T14:36:24Z</dc:date>
    </item>
  </channel>
</rss>

