Splunk Dev

Python SDK: How to bypass max count in limits.conf to return all event results?

guilmxm
SplunkTrust
SplunkTrust

Hi All,

I'm currently working on some duplicate prevention scripts in Python, for this i am looking for a simple Python code example that would allow bypassing the max number of events set in limits.conf

Using the "search.py" provided in example won't allow bypassing the limits.conf max event limit, i found this link:

http://answers.splunk.com/answers/39243/python-sdk-results-limited-to-50-000.html

And some others for C# and Java, but i don't get it to be honest...

A simple code sample would be very helpful for me...and others with the same need 🙂

Thanks in advance for you help !

Tags (3)
1 Solution

guilmxm
SplunkTrust
SplunkTrust

For people looking for the same need, i finally found my solution on Splunk dev using REST API with a simple Python script, i can retrieve the full event no matters the number of events 🙂

Works great and very simple !

http://dev.splunk.com/view/basic-tutorial/SP-CAAADQT

Python sample script:

#!/usr/bin/env python

import urllib, urllib2
from xml.dom import minidom

base_url = 'https://localhost:8089'
username = 'admin'
password = 'changeme'
search_query = 'search error | head 10'

# Login and get the session key
request = urllib2.Request(base_url + '/servicesNS/%s/search/auth/login' % (username), 
    data = urllib.urlencode({'username': username, 'password': password}))
server_content = urllib2.urlopen(request)

session_key = minidom.parseString(server_content.read()).\
        getElementsByTagName('sessionKey')[0].childNodes[0].nodeValue
print "Session Key: %s" % session_key 

# Perform a search
request = urllib2.Request(base_url + '/servicesNS/%s/search/search/jobs/export' % (username), 
    data = urllib.urlencode({'search': search_query,'output_mode': 'csv'}),
    headers = { 'Authorization': ('Splunk %s' %session_key)})
search_results = urllib2.urlopen(request)
print search_results.read()

View solution in original post

guilmxm
SplunkTrust
SplunkTrust

For people looking for the same need, i finally found my solution on Splunk dev using REST API with a simple Python script, i can retrieve the full event no matters the number of events 🙂

Works great and very simple !

http://dev.splunk.com/view/basic-tutorial/SP-CAAADQT

Python sample script:

#!/usr/bin/env python

import urllib, urllib2
from xml.dom import minidom

base_url = 'https://localhost:8089'
username = 'admin'
password = 'changeme'
search_query = 'search error | head 10'

# Login and get the session key
request = urllib2.Request(base_url + '/servicesNS/%s/search/auth/login' % (username), 
    data = urllib.urlencode({'username': username, 'password': password}))
server_content = urllib2.urlopen(request)

session_key = minidom.parseString(server_content.read()).\
        getElementsByTagName('sessionKey')[0].childNodes[0].nodeValue
print "Session Key: %s" % session_key 

# Perform a search
request = urllib2.Request(base_url + '/servicesNS/%s/search/search/jobs/export' % (username), 
    data = urllib.urlencode({'search': search_query,'output_mode': 'csv'}),
    headers = { 'Authorization': ('Splunk %s' %session_key)})
search_results = urllib2.urlopen(request)
print search_results.read()
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...