All Apps and Add-ons

how to get event string from ResultsReader (python)

rgrimsha
New Member

I am following the documentation example except I am searching for syslog data. i.e. DHCPRELEASE
and the results I get from ResultsReader include the time, server etc - everything except the data string i.e. the MacAddress that released. How can I get the syslog string data for the event? Thank you.

Tags (1)
0 Karma

dart
Splunk Employee
Splunk Employee

The _raw field is the event text.

0 Karma

bradp123
Path Finder

@rgrimsha, I am also getting a truncated _raw field in my results. Did you figure out how to get the full line of text back with the python SDK? It seems the text is truncated after the word in my search query.

0 Karma

rgrimsha
New Member

Looking a little deeper, the data is correctly being returned in the query. it is being truncated by the results.ResultsReader function used in the example. The returned data looks a little like this (sanitized) Feb 12 13:50:13 hostname dhcpd: DHCPRELEASE of 123.456.789.321 from 22:33:44:55:66:77 via eth0 (found)
but the ResultsReader stops before the <sg for the _raw field.

0 Karma

rgrimsha
New Member

Thank you, I do see the _raw fieldname and some data... but it is truncated to only show the timestamp server and application portion.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...