All Apps and Add-ons

how to get event string from ResultsReader (python)

rgrimsha
New Member

I am following the documentation example except I am searching for syslog data. i.e. DHCPRELEASE
and the results I get from ResultsReader include the time, server etc - everything except the data string i.e. the MacAddress that released. How can I get the syslog string data for the event? Thank you.

Tags (1)
0 Karma

dart
Splunk Employee
Splunk Employee

The _raw field is the event text.

0 Karma

bradp123
Path Finder

@rgrimsha, I am also getting a truncated _raw field in my results. Did you figure out how to get the full line of text back with the python SDK? It seems the text is truncated after the word in my search query.

0 Karma

rgrimsha
New Member

Looking a little deeper, the data is correctly being returned in the query. it is being truncated by the results.ResultsReader function used in the example. The returned data looks a little like this (sanitized) Feb 12 13:50:13 hostname dhcpd: DHCPRELEASE of 123.456.789.321 from 22:33:44:55:66:77 via eth0 (found)
but the ResultsReader stops before the <sg for the _raw field.

0 Karma

rgrimsha
New Member

Thank you, I do see the _raw fieldname and some data... but it is truncated to only show the timestamp server and application portion.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...