https://community.splunk.com/t5/Splunk-Search/How-to-splunk-api-to-get-statistics-in-python/m-p/694611#M236239 <P><BR />If I run the below code I am getting events in output json file , if I want to get statistics , is there any api available&nbsp;<BR />if I want to get error count and stdev in json file , how can I use the python code to get these values</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="rajendar381_0-1722006898483.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/31963i1EEDD28DD93E52E2/image-size/large?v=v2&amp;px=999" role="button" title="rajendar381_0-1722006898483.png" alt="rajendar381_0-1722006898483.png" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">rajendar381_0-1722006898483.png</span></span></P><P>&nbsp;</P><LI-CODE lang="python">payload=f'search index="prod_k8s_onprem_vvvb_nnnn" "k8s.namespace.name"="apl-siii-iiiii" "k8s.container.name"="uuuu-dss-prog" NOT k8s.container.name=istio-proxy NOT log.level IN(DEBUG,INFO) (error OR exception)(earliest="07/25/2024:11:30:00" latest="07/25/2024:12:30:00")\n' '| addinfo\n' '| bin _time span=5m@m\n' '| stats count(eval(log.level="ERROR")) as error_count by _time\n' '| eventstats stdev(error_count)' print(payload) payload_escaped = f'search={urllib.parse.quote(payload)}' headers = { 'Authorization': f'Bearer {splunk_token}', 'Content-Type': 'application/x-www-form-urlencoded' } url = f'https://{splunk_host}:{splunk_port}/services/search/jobs/export?output_mode=json' response = requests.request("POST", url, headers=headers, data=payload_escaped, verify=False) print(f'{response.status_code=}') txt = response.text if response.status_code==200: json_txt = f'[\n{txt}]' os.makedirs('data', exist_ok=True) with open("data/output_deploy.json", "w") as f: f.write(json_txt) f.close() else: print(txt)</LI-CODE><P>&nbsp;</P><P><BR /><BR /></P> Mon, 29 Jul 2024 22:29:56 GMT rajendar381 2024-07-29T22:29:56Z https://community.splunk.com/t5/Splunk-Search/How-to-splunk-api-to-get-statistics-in-python/m-p/694611#M236239 <P><BR />If I run the below code I am getting events in output json file , if I want to get statistics , is there any api available&nbsp;<BR />if I want to get error count and stdev in json file , how can I use the python code to get these values</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="rajendar381_0-1722006898483.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/31963i1EEDD28DD93E52E2/image-size/large?v=v2&amp;px=999" role="button" title="rajendar381_0-1722006898483.png" alt="rajendar381_0-1722006898483.png" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">rajendar381_0-1722006898483.png</span></span></P><P>&nbsp;</P><LI-CODE lang="python">payload=f'search index="prod_k8s_onprem_vvvb_nnnn" "k8s.namespace.name"="apl-siii-iiiii" "k8s.container.name"="uuuu-dss-prog" NOT k8s.container.name=istio-proxy NOT log.level IN(DEBUG,INFO) (error OR exception)(earliest="07/25/2024:11:30:00" latest="07/25/2024:12:30:00")\n' '| addinfo\n' '| bin _time span=5m@m\n' '| stats count(eval(log.level="ERROR")) as error_count by _time\n' '| eventstats stdev(error_count)' print(payload) payload_escaped = f'search={urllib.parse.quote(payload)}' headers = { 'Authorization': f'Bearer {splunk_token}', 'Content-Type': 'application/x-www-form-urlencoded' } url = f'https://{splunk_host}:{splunk_port}/services/search/jobs/export?output_mode=json' response = requests.request("POST", url, headers=headers, data=payload_escaped, verify=False) print(f'{response.status_code=}') txt = response.text if response.status_code==200: json_txt = f'[\n{txt}]' os.makedirs('data', exist_ok=True) with open("data/output_deploy.json", "w") as f: f.write(json_txt) f.close() else: print(txt)</LI-CODE><P>&nbsp;</P><P><BR /><BR /></P> Mon, 29 Jul 2024 22:29:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-splunk-api-to-get-statistics-in-python/m-p/694611#M236239 rajendar381 2024-07-29T22:29:56Z