Building for the Splunk Platform

python sdk and realtime search?

bfaber
Communicator

I am trying to get realtime streaming results using the python sdk. The code I was using looks like this:

auth.getSessionKey('admin','changeme')
args = {"earliestTime": 0, "latestTime": 0}
job = search.dispatch(' search *',**args)

for event in job:
  print  event['_raw']

print search
job.cancel()

No errors, but no results either. What am I doing wrong?

Tags (2)
1 Solution

bfaber
Communicator

Using the Job Inspector, I was able to reverse the kwargs...

args = {'time_format': '%s.%Q', 'search': 'search *', 'required_field_list': '*', 'max_count': '10000', 'ui_dispatch_app': 'search', 'latest_time': 'rt', 'status_buckets': '300', 'ui_dispatch_view': 'flashtimeline', 'earliest_time': 'rt-1m', 'auto_cancel': '100'}

This changes the search line to be:

job = search.dispatch(**args)

This all seems to work, but is probably more complex than needed.

View solution in original post

psanford_splunk
Splunk Employee
Splunk Employee

There is also a new Splunk Python SDK on GitHub. You can access it here: https://github.com/splunk/splunk-sdk-python

There are a number of search examples in the SDK.

Any questions - psanford@splunk.com or ping us on Twitter: @splunkdev

0 Karma

bfaber
Communicator

Using the Job Inspector, I was able to reverse the kwargs...

args = {'time_format': '%s.%Q', 'search': 'search *', 'required_field_list': '*', 'max_count': '10000', 'ui_dispatch_app': 'search', 'latest_time': 'rt', 'status_buckets': '300', 'ui_dispatch_view': 'flashtimeline', 'earliest_time': 'rt-1m', 'auto_cancel': '100'}

This changes the search line to be:

job = search.dispatch(**args)

This all seems to work, but is probably more complex than needed.

Lowell
Super Champion

Have you tried adding rt to your earliest/lastest times?

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...