Splunk-Python (requests.get) outputs only first 100 events

vamsigurram — Wed, 25 Nov 2020 04:50:33 GMT

I wrote the below python code, which is giving me only first 100 events.

I checked online docs, i saw "count = 0" as a solution, to get all results, but that option only works for Splunk SDK (splunklib.client.service)

I am using python's requests library.

Need help in looping/pagination of all the results of this search id (%sid)

import requests
import json

url = base_url + "/services/search/jobs/%s/results" % sid
headers = {
"content-type": "application/x-www-form-urlencoded",
"Authorization": "Splunk %s" % sessionkey
}
payload = {

"output_mode": "json"

}
res = requests.get(url, headers=headers, params=payload, verify = False)
result = json.loads(res.text)["results"]

print("length is %s" % len(result)) =================> Output here is 100

Re: Splunk-Python (requests.get) outputs only first 100 events

vamsigurram — Wed, 25 Nov 2020 05:05:59 GMT

As soon as i posted this question, i found the answer.

Its indeed count = 0 the answer, as highlighted below.
Been struggling with this for 2 days. But answer is so simple.

"count": 0

}
res = requests.get(url, headers=headers, params=payload, verify = False)
result = json.loads(res.text)["results"]

print("length is %s" % len(result))

topic Re: Splunk-Python (requests.get) outputs only first 100 events in Splunk Dev

Splunk-Python (requests.get) outputs only first 100 events

Re: Splunk-Python (requests.get) outputs only first 100 events