topic Re: search by Http code 500 is not working in Splunk Search

search by Http code 500 is not working

BalajiRaju — Mon, 10 Feb 2025 06:39:33 GMT

Team,

when we search by http code 500 internal server error in the Splunk is working fine. the same query which we use it in python script. we dont get any results. could you please help me on this. Thanks

Re: search by Http code 500 is not working

dataisbeautiful — Mon, 10 Feb 2025 08:12:05 GMT

hi @BalajiRaju

Can you provide the base search you're using in Splunk and the Python code for us to see?

Re: search by Http code 500 is not working

BalajiRaju — Mon, 10 Feb 2025 09:17:45 GMT

import splunklib.client as client

import splunklib.results as results

service = client.connect(

host="ipaddress",

port=portnumber,

username="username",

password="password",

scheme = "https"

)

kwargs_blockingsearch = {"exec_mode": "normal",

"earliest_time": "-15m",

"latest_time": "now",

"enable_lookups": "true"}

searchquery_blocking = '''search index=sample source="*sample*" AND host="v*lu*" OR host="s*mple*" | search httpcode=500 '''

job = service.jobs.create(searchquery_blocking, **kwargs_blockingsearch)

while True:

while not job.is_ready():

pass

if job["isDone"] =="1":

break

results = job.results(**{"output_mode": "json"})

print(results)

Re: search by Http code 500 is not working

dataisbeautiful — Mon, 10 Feb 2025 09:32:28 GMT

If you remove

| search httpcode=500

from the python, does it return all the data as expected from the parent index?

Re: search by Http code 500 is not working

BalajiRaju — Mon, 10 Feb 2025 09:34:23 GMT

yes. correct. if i remove | search httpcode = 500, i can get the results

Re: search by Http code 500 is not working

BalajiRaju — Mon, 10 Feb 2025 12:38:40 GMT

@dataisbeautiful do you have any solution for this issue?

Re: search by Http code 500 is not working

dataisbeautiful — Mon, 10 Feb 2025 13:34:42 GMT

If the search without the filter returns all the data, then the filter is removing too much.

When running in the Python are the data types being changed? In Splunk the httpcode might be an integer but Python sees it as a string?

Can you validate the data from the Python to confirm the value of httpcode is what you're expecting?

Re: search by Http code 500 is not working

BalajiRaju — Tue, 11 Feb 2025 05:49:38 GMT

@dataisbeautiful Tried to use the below query also but no luck.

searchquery_blocking = '''search index=sample source="*sample*" AND host="v*lu*" OR host="s*mple*" | search httpcode="500" '''

still not getting any results. Its strange. I have been stuck on this for three days.

Re: search by Http code 500 is not working

dataisbeautiful — Tue, 11 Feb 2025 09:05:02 GMT

@BalajiRaju

When wrapping your query in quotes, do you escape the ones contained inside?

For example

query=" index=\"name\" "

Re: search by Http code 500 is not working

PickleRick — Tue, 11 Feb 2025 09:32:40 GMT

@dataisbeautifulThis is not needed. The string is defined with triple single quotes as long string and therefore double quotes do not need to be escaped.

@BalajiRaju If your base search returns values and your filtering part causes it to not return any events at all, that would mean that you're filtering it wrong. There can be several reasons, most obvious would be that the httpcode field isn't properly extracted from the events (or simply your data doesn't have any 500 results).

Do you have any webui access or is REST the only way you're accessing your Splunk installation?

Re: search by Http code 500 is not working

BalajiRaju — Tue, 11 Feb 2025 09:52:56 GMT

@PickleRick Yes. I have web UI access also. When I search the query in Web splunk, I get the results. the same query when i execute it in splunk rest api via python script, not getting any results. I dont know why.

Re: search by Http code 500 is not working

PickleRick — Tue, 11 Feb 2025 09:55:52 GMT

That is interesting. Are you using the same user to search from WebUI as you're using for API access?

If not, that could mean some differences in permissions to knowledge objects - in your case - field extractions.

Re: search by Http code 500 is not working

BalajiRaju — Tue, 11 Feb 2025 10:13:18 GMT

@PickleRick Yes. I'm using the same user with both Web UI and Rest API access.

Re: search by Http code 500 is not working

BalajiRaju — Tue, 11 Feb 2025 12:33:23 GMT

@PickleRick @dataisbeautiful Finally find the reason. unable to use the fields from splunk rest api. thats why we couldnt get the results. I will use the _raw data to find out the 500 http code and get the results. Thanks for your reply.

Re: search by Http code 500 is not working

PickleRick — Tue, 11 Feb 2025 12:41:48 GMT

Yeah but the question is why you don't see the fields when spawning the search from the REST api. That's unexpected. If you're using the same user, which should obviously have the same permissions for knowledge objects, you should be getting the same behaviour.

Just to be on the safe side - your WebUI SH is the same you're spawning your REST API search against?

Re: search by Http code 500 is not working

dataisbeautiful — Tue, 11 Feb 2025 15:43:38 GMT

Not seeing the fields will stop your filter from working, but why is the question.