One shot search with Python SDK

brent_weaver — Mon, 13 Aug 2018 12:27:58 GMT

I am reading the documentation to create a simple search script:

#!/usr/bin/env python

import os
import sys
import json
import argparse
import datetime
from random import choice

try:
  import splunklib.client as client
  import splunklib.results as results
except:
  print('')
  print('Please install the Splunk Python SDK via # pip install splunk-sdk [http://dev.splunk.com/python]')
  print('')
  quit(1)

#################################################
### Deal with arguments vars and file handles ###
#################################################

token = ''.join([choice('abcdefghijklmnopqrstuvwxyz0123456789') for i in range(64)])

parser = argparse.ArgumentParser(description='Python Script to test Splunk functionality')
parser.add_argument('-H', help='Hostname to target', required=True)
parser.add_argument('-u', help='Splunk Username', required=True)
parser.add_argument('-p', help='Splunk Password', required=True)
parser.add_argument('-P', help='API Port, default = 8089', default="8089")
args = parser.parse_args()

## Connect to Splunk
try:
  sdk = client.connect(host=args.H,port=args.P,username=args.u,password=args.p)
except:
  print "Error connecting..."


kwargs_oneshot = {"earliest_time": "2018-08-132T12:00:00.000-07:00",
                  "latest_time": "2018-09-13T12:00:00.000-07:00"}
searchquery_oneshot = "search * | head 10"

oneshotsearch_results = sdk.jobs.oneshot(searchquery_oneshot, **kwargs_oneshot)

# Get the results and display them using the ResultsReader
reader = results.ResultsReader(oneshotsearch_results)
for item in reader:
    print(item)

This produces no results. What am I missing? This does not seem to be a fully functioning search. I should say that the only index that has events is _internal.

Re: One shot search with Python SDK

jerryebladesjr — Thu, 02 Oct 2025 20:07:31 GMT

I also found this, and spent hours on this before I discovered that only the "oneshot" type of search does the issue present.

Submitted https://github.com/splunk/splunk-sdk-python/issues/678 on it.

convert your reader var to a list, then iterate through it to resolve, like:

reader = JSONResultsReader(result_stream)
reader2 = list(reader)
for item in reader2:
    print(item)

topic Re: One shot search with Python SDK in Splunk Search

One shot search with Python SDK

Re: One shot search with Python SDK