Why am I getting no results returned using the Splunk Python SDK to search our Splunk instance?

rchoul — Wed, 14 Sep 2016 19:26:24 GMT

I'm using the Splunk Python SDK search our Splunk instance. However, I'm not getting any results.

Below is the code I'm using:

import sys
from time import sleep
import splunklib.client as client
import splunklib.results as results

count=0

HOST = "abc"
PORT = 8089
USERNAME = "user"
PASSWORD = "password"

service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)

search_query = "search * | head 10"
kwargs_normalsearch = {"exec_mode": "normal"}

job = service.jobs.create(search_query, **kwargs_normalsearch)

while True:
    while not job.is_ready():
        pass
    stats = {"isDone": job["isDone"],
             "doneProgress": float(job["doneProgress"])*100,
              "scanCount": int(job["scanCount"]),
              "eventCount": int(job["eventCount"]),
              "resultCount": int(job["resultCount"])}

status = ("\r%(doneProgress)03.1f%%   %(scanCount)d scanned   "
          "%(eventCount)d matched   %(resultCount)d results") % stats

sys.stdout.write(status)
sys.stdout.flush()
if stats["isDone"] == "1":
    sys.stdout.write("\n\nDone!\n\n")
    break
sleep(2)

The connection is successful and I'm able to retrieve the list of apps but when I query it doesn't return any result. In fact, it says no result found. Below is the output I see when I run the query.

Connected Successfully

0.0% 0 scanned 0 matched 0 results
100.0% 0 scanned 0 matched 0 results

Done!

When I run this query i.e. 'search *' in the Web UI I do get results. I'm learning to use splunk and its python SDK so any help is immensely appreciated.

Thank you,
Regards

Re: Why am I getting no results returned using the Splunk Python SDK to search our Splunk instance?

thomrs — Fri, 16 Sep 2016 17:34:34 GMT

This works for me:

while True:
    job.refresh()
    if job["isDone"] == "1":
        print job["eventCount"]
        break

Re: Why am I getting no results returned using the Splunk Python SDK to search our Splunk instance?

rchoul — Fri, 16 Sep 2016 17:40:59 GMT

I'm still getting 0 as the output. Could there be something wrong in my query itself?

Regards

Re: Why am I getting no results returned using the Splunk Python SDK to search our Splunk instance?

thomrs — Fri, 16 Sep 2016 18:09:36 GMT

Search looks right, if you add

print job["sid"]

you can get the job id and look it up under activity -> jobs.

topic Re: Why am I getting no results returned using the Splunk Python SDK to search our Splunk instance? in Splunk Search

Why am I getting no results returned using the Splunk Python SDK to search our Splunk instance?

Re: Why am I getting no results returned using the Splunk Python SDK to search our Splunk instance?

Re: Why am I getting no results returned using the Splunk Python SDK to search our Splunk instance?

Re: Why am I getting no results returned using the Splunk Python SDK to search our Splunk instance?