Splunk Dev

Splunk-Python (requests.get) outputs only first 100 events

vamsigurram
Path Finder

 

I wrote the below python code, which is giving me only first 100 events.

I checked online docs, i saw "count = 0" as a solution, to get all results, but that option only works for Splunk SDK (splunklib.client.service)

I am using python's requests library.

Need help in looping/pagination of all the results of this search id (%sid)

 

import requests
import json

url = base_url + "/services/search/jobs/%s/results" % sid
headers = {
"content-type": "application/x-www-form-urlencoded",
"Authorization": "Splunk %s" % sessionkey
}
payload = {

"output_mode": "json"

}
res = requests.get(url, headers=headers, params=payload, verify = False)
result = json.loads(res.text)["results"]

print("length is %s" % len(result)) =================> Output here is 100

 

 

Labels (1)
0 Karma
1 Solution

vamsigurram
Path Finder

As soon as i posted this question, i found the answer.

Its indeed count = 0 the answer, as highlighted below.
Been struggling with this for 2 days. But answer is so simple.

url = base_url + "/services/search/jobs/%s/results" % sid
headers = {
"content-type": "application/x-www-form-urlencoded",
"Authorization": "Splunk %s" % sessionkey
}
payload = {

"output_mode": "json",

"count": 0

}
res = requests.get(url, headers=headers, params=payload, verify = False)
result = json.loads(res.text)["results"]

print("length is %s" % len(result))

View solution in original post

0 Karma

vamsigurram
Path Finder

As soon as i posted this question, i found the answer.

Its indeed count = 0 the answer, as highlighted below.
Been struggling with this for 2 days. But answer is so simple.

url = base_url + "/services/search/jobs/%s/results" % sid
headers = {
"content-type": "application/x-www-form-urlencoded",
"Authorization": "Splunk %s" % sessionkey
}
payload = {

"output_mode": "json",

"count": 0

}
res = requests.get(url, headers=headers, params=payload, verify = False)
result = json.loads(res.text)["results"]

print("length is %s" % len(result))

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...