Splunk Dev

Script python with search SPL

wcastillocruz
Path Finder

Hello Splunk team,

do you know if it's possible to do a splunk search in a python script? taking into account the selection of the desired period (last week, last month ...).

for example for a simple search :

| append [search sourcetype=ESP_Histo env="Web" service="Application" apps="Web Sharepoints" fn="*" managed_entity="*- URL" sampler="SHAREPOINT - URL" ID_EVENT | eval Applications=case( apps like "%Web Sharepoints%","WEB SHAREPOINTS") | `transactions` ]

| eval max_time=if(info_max_time == "+Infinity", now(), info_max_time) | eval min_time=if(info_min_time == "0.000", 1577836800, info_min_time) | eval periode1=max_time-min_time
| stats sum(duration) AS durationindispo by Applications, periode1

| outputcsv append=true override_if_empty=false web_search

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, it's possible to perform a search in a Python script.  See https://docs.splunk.com/Documentation/Splunk/8.2.2/RESTREF/RESTsearch for the details.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Yes, it's possible to perform a search in a Python script.  See https://docs.splunk.com/Documentation/Splunk/8.2.2/RESTREF/RESTsearch for the details.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...