Building for the Splunk Platform

Splunk Python SDKm cannot get results from a query

dfofie
New Member

I'm using the latest Python SDK to send some requests to splunk, since i need to obtain those data from a script.
Somehow I'm unable to get the data, and the request is not failing, That says everything seems to be correctly working, but no results is returned.
I'm using exactly the same username/password combination as for the web login, sending the same request, From the web search, i get many thousands of results, but from the Python script, 0. This is the code snippet:

searchquery_normal = "search index=testing_cc_ps  sourcetype=doors_as"
kwargs_normalsearch = {"earliest_time": "@d",
                       "latest_time": "now",
                       "exec_mode": "blocking"}
job = splunk_service.jobs.create(searchquery_normal, **kwargs_normalsearch)

# A normal search returns the job's SID right away, so we need to poll for completion
while True:
    while not job.is_ready():
        print("Job is not ready")
        pass
    stats = {"isDone": job["isDone"],
             "doneProgress": float(job["doneProgress"]) * 100,
             "scanCount": int(job["scanCount"]),
             "eventCount": int(job["eventCount"]),
             "resultCount": int(job["resultCount"])}

    status = ("\r%(doneProgress)03.1f%%   %(scanCount)d scanned   "
              "%(eventCount)d matched   %(resultCount)d results") % stats

    sys.stdout.write(status)
    sys.stdout.flush()
    if stats["isDone"] == "1":
        sys.stdout.write("\n\nDone!\n\n")
        break
    sleep(2)

# Get the results and display them
for result in results.ResultsReader(job.results()):
    print(result)

job.cancel()
sys.stdout.write('\n')

That is the output

100.0% 0 scanned 0 matched 0 results
Done!

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

It looks like you are hitting same issue as explained in question https://answers.splunk.com/answers/691052/why-are-our-splunk-python-sdk-query-results-empty.html , try with sleep(5) after print("Job is not ready") line in while loop.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...