topic Python SDK Oneshot in Splunk Dev

Python SDK Oneshot

dannyze — Mon, 31 Aug 2020 02:26:11 GMT

Working with the Python SDK, and my end goal is to fetch logs over a given time.

For now I'm trying to output saved searches and then later will move on to the logs.
Referencing the docs, this is close to what I want to do, minus the delete portion
https://docs.splunk.com/DocumentationStatic/PythonSDK/1.6.5/client.html?highlight=saved%20searches#splunklib.client.SavedSearches

Something like

for saved_search in saved_searches.iter(pagesize=10): print(saved_search)

but not getting any output, any ideas on where to go?

For clarity using the oneshot method, and want to output saved search results.

Re: Python SDK Oneshot

gaurav_maniar — Mon, 31 Aug 2020 09:07:29 GMT

Hi,

Please check the below documentation. I guess it will help with executing saved searches and displaying results.

Let me know if you need more details or help.

https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtowork/#To-run-a-saved-search-and-display-search-results

Re: Python SDK Oneshot

dannyze — Mon, 31 Aug 2020 22:50:39 GMT

Thank you going through the documentation it seems like this would be it. However I am not getting any output. Are there more details about this API that can help here?

The following is the snippet that would perform listing of the saved search

password = knox_auth(SPLUNK_PASSWORD) service = client.connect(host=HOST, port=PORT, username=USERNAME, password=password, basic=True, app=APP) # return service # Retrieve a search savedsearch = service.saved_searches["Saved Search"] job = savedsearch.dispatch() print(job.results())

Thank You

Re: Python SDK Oneshot

dannyze — Thu, 10 Sep 2020 23:42:19 GMT

Thank you going through the documentation it seems like this would be it. However I am not getting any output. Are there more details about this API that can help int his use case?