Splunk Dev

Splunk-Python (requests.get) outputs only first 100 events

vamsigurram
Path Finder

 

I wrote the below python code, which is giving me only first 100 events.

I checked online docs, i saw "count = 0" as a solution, to get all results, but that option only works for Splunk SDK (splunklib.client.service)

I am using python's requests library.

Need help in looping/pagination of all the results of this search id (%sid)

 

import requests
import json

url = base_url + "/services/search/jobs/%s/results" % sid
headers = {
"content-type": "application/x-www-form-urlencoded",
"Authorization": "Splunk %s" % sessionkey
}
payload = {

"output_mode": "json"

}
res = requests.get(url, headers=headers, params=payload, verify = False)
result = json.loads(res.text)["results"]

print("length is %s" % len(result)) =================> Output here is 100

 

 

Labels (1)
0 Karma
1 Solution

vamsigurram
Path Finder

As soon as i posted this question, i found the answer.

Its indeed count = 0 the answer, as highlighted below.
Been struggling with this for 2 days. But answer is so simple.

url = base_url + "/services/search/jobs/%s/results" % sid
headers = {
"content-type": "application/x-www-form-urlencoded",
"Authorization": "Splunk %s" % sessionkey
}
payload = {

"output_mode": "json",

"count": 0

}
res = requests.get(url, headers=headers, params=payload, verify = False)
result = json.loads(res.text)["results"]

print("length is %s" % len(result))

View solution in original post

0 Karma

vamsigurram
Path Finder

As soon as i posted this question, i found the answer.

Its indeed count = 0 the answer, as highlighted below.
Been struggling with this for 2 days. But answer is so simple.

url = base_url + "/services/search/jobs/%s/results" % sid
headers = {
"content-type": "application/x-www-form-urlencoded",
"Authorization": "Splunk %s" % sessionkey
}
payload = {

"output_mode": "json",

"count": 0

}
res = requests.get(url, headers=headers, params=payload, verify = False)
result = json.loads(res.text)["results"]

print("length is %s" % len(result))

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...