topic Re: Splunk Search results as CSV- python in Splunk Search

Splunk Search results as CSV- python

poorni_p — Sun, 14 Jul 2019 06:14:29 GMT

I am trying to get the results as CSV file with the help of this page https://www.splunk.com/blog/2011/08/02/splunk-rest-api-is-easy-to-use.html. i modified few things and successfully getting session id and SID, but getting the below error for the "Get the search status" query.

code:

    servicesSearchStatusSTR='/services/search/jobs/%s/' %sid
    isNotDone = True
    myhttp.add_credentials('username','pwd')
    while isNotDone:
        searchStatus = httplib2.Http(disable_ssl_certificate_validation=True).request(baseurl + servicesSearchStatusSTR,'GET', headers={'Authorization':'Splunk %s' % sessionkey},  body=urllib.parse.urlencode({'search':searchQuery}))[1]                                                                   
        isDoneStatus = re.compile('isDone">(0|1)')
        print(isDoneStatus)
        isDoneStatus =isDoneStatus.search(searchStatus).groups()[0]\
        if(isDoneStatus == '1'):
                     isNotDone = False

print("%s", isDoneStatus)

Error:
Traceback (most recent call last):
File "sample.py", line 46, in
isDoneStatus =isDoneStatus.search(searchStatus).groups()[0]\
TypeError: cannot use a string pattern on a bytes-like object

Please help me to resolve this error.

Re: Splunk Search results as CSV- python

renjith_nair — Mon, 15 Jul 2019 06:02:00 GMT

@poorni_p,

searchStatus is an html response (a byte like object) and you need to convert that to string before doing a regex search.

Try adding this to your code just below the searchStatus(line 5 in your code snippet)

    searchStatus = searchStatus.decode('utf-8')

Re: Splunk Search results as CSV- python

eavent_splunk — Mon, 15 Jul 2019 06:57:39 GMT

I'm not a Python expert, but from my testing on Python 2.7 I think you might just have to remove the backslash at the end of this line:

 isDoneStatus =isDoneStatus.search(searchStatus).groups()[0]\