Splunk Dev

Truncated _raw field with Python SDK

bradp123
Path Finder

Hello,

I am following the python SDK examples to pull data from a job. Here is my search code:


...
searchquery_normal = "search block | head 20"
job = service.jobs.create(searchquery_normal)
...
for result in results.ResultsReader(job.results()):
print result["_raw"]

When I get the results back I am only getting a portion of the text in the raw field. In the GUI I get the full log text, in the SDK the text truncates after the work "block". Is this normal Splunk behavior? How do I get the full line of text?

Tags (2)
0 Karma

bradp123
Path Finder
0 Karma
Get Updates on the Splunk Community!

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...