Developing for Splunk Enterprise
Highlighted

splunklib sourcetype

Explorer

In the splunk UI, I can have a query such as the following...

host="cmhlpecomweb*" sourcetype=access_combined "GET /check-out/actions/gift-card-submit.jsp"

I have been unable to find how to do this through the splunklib python client.

I have tried numerous combinations, and can find no referecne to how to do this in the Splunk documention.

Examples of what has been tried

service.jobs.export("host=cmhlpecomweb* sourcetype=accesscombined | search GET /check-out/actions/gift-card-submit.jsp",
**{"earliest
time":"2017-02-13T10:00:00.000-07:00"}))

service.jobs.export("regex field= host=cmhlpecomweb* sourcetype=accesscombined | search GET /check-out/actions/gift-card-submit.jsp",
**{"earliest
time":"2017-02-13T10:00:00.000-07:00"}))

service.jobs.export("search GET /check-out/actions/gift-card-submit.jsp | host=cmhlpecomweb* sourcetype=accesscombined ",
**{"earliest
time":"2017-02-13T10:00:00.000-07:00"}))

service.jobs.export("search GET /check-out/actions/gift-card-submit.jsp host=cmhlpecomweb* sourcetype=accesscombined ",
**{"earliest
time":"2017-02-13T10:00:00.000-07:00"}))

Surely this can't be this difficult, but after spending the better part of an afternoon, I give up. Is this documented, or even possible? If documented, a pointer to that info would be great!

0 Karma
Highlighted

Re: splunklib sourcetype

SplunkTrust
SplunkTrust

Are you using the results reader?

http://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Search/ExportdatausingSDKs

import splunklib.client as client
import splunklib.results as results
service = client.connect(…)
rr = results.ResultsReader(service.jobs.export("search index=_internal earliest=-1h | head

View solution in original post

0 Karma
Highlighted

Re: splunklib sourcetype

Explorer

I think I found this, as the following works...

rr = results.ResultsReader(service.jobs.export("search host=\"cmhlpecomweb*\" sourcetype=access_combined GET /catalog/actions/giftcard-balance-submit.jsp", 
                                               **{"earliest_time":"2016-12-31T23:57:00.000-05:00",
                                                  "latest_time":"2017-01-01T00:00:00.000-05:00"}))

I think a more complete example should be in the docs for this, rather than search * | head 5.

Regardless, it works, so thanks to anyone that gave this some thought.

Highlighted

Re: splunklib sourcetype

Explorer

Hi,

I am, but the syntax I had above consistently threw exceptions. I have since found that I can simply prefix the same search string with "search" (go figure :)), and escape the double quotations for host. After that, it works.

I will wait to verify I am not still missing anything, and then accept your answer.

Thanks,

Steve

0 Karma
Highlighted

Re: splunklib sourcetype

SplunkTrust
SplunkTrust

you can escape your quotes if you need them just add a \ before them ... \" should work... maybe \"

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.