Splunk Dev

Python SDK Oneshot

dannyze
Explorer

Working with the Python SDK, and my end goal is to fetch logs over a given time.

For now I'm trying to output saved searches and then later will move on to the logs.
Referencing the docs, this is close to what I want to do, minus the delete portion

https://docs.splunk.com/DocumentationStatic/PythonSDK/1.6.5/client.html?highlight=saved%20searches#s...

Something like

for saved_search in saved_searches.iter(pagesize=10):
    print(saved_search)




but not getting any output, any ideas on where to go?

For clarity using the oneshot method, and want to output saved search results. 



Labels (2)
0 Karma

dannyze
Explorer

Thank you going through the documentation it seems like this would be it. However I am not getting any output. Are there more details about this API that can help  int his use case? 

 

0 Karma

dannyze
Explorer

Thank you going through the documentation it seems like this would be it. However I am not getting any output. Are there more details about this API that can help here? 

The following is the snippet that would perform listing of the saved search

  password = knox_auth(SPLUNK_PASSWORD)
    service = client.connect(host=HOST, port=PORT, username=USERNAME,
            password=password, basic=True, app=APP)
    # return service

    # Retrieve a search
    savedsearch = service.saved_searches["Saved Search"]
    job = savedsearch.dispatch()
    print(job.results())

 
Thank You

0 Karma

gaurav_maniar
Builder

Hi,

Please check the below documentation. I guess it will help with executing saved searches and displaying results.

Let me know if you need more details or help.

https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtowork/#To...

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...