Getting Data In

How many times it executes splunk search and export using python rest api ?

poorni_p
Explorer

Hi all,
I am writing a python rest api script to search and export csv results to a location.
I got the session key for the below query.

     serviceContent=httplib2.Http.request(...)
     sessionkey = minidom.parseString(serviceContent).getElementsByTagName('sessionKey')[0].childNodes[0].nodeValue

And using this session key, i am writing a infinite while loop to execute search and import csv file

  while true:
           ...
         #splunk Search using the Session key and got job id here
         #Get results & Export to CSV statement here
         #time.sleep(60) statement here to run the search every minute
         ...

My query is how many times the while look will get executed with the Session key?

thanks in advance.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

I can't validate this but I wonder if it would be defined by the sessionTimeout property of server.conf

[general]
sessionTimeout = <nonnegative integer>[s|m|h|d]
* The amount of time before a user session times out, expressed as a
  search-like time range.
* Examples include "24h" (24 hours), "3d" (3 days),
  "7200s" (7200 seconds, or two hours)
* Default: "1" (1 hour)

So if the session is active then it may never expire because I believe this is more about inactive sessions.

0 Karma

poorni_p
Explorer

@SloshBurch
Not sure about server.conf, but i guess this can be defined in Settings in the upper right-hand corner -> Server settings -> Click General settings -> Session timeout.

any thoughts ?

0 Karma

sloshburch
Splunk Employee
Splunk Employee

I believe we're talking about the same thing. I mentioned where it is in the conf file and I think you found where it is in the UI. Let's see if I can get some developers to peek at this as well.

0 Karma

jkat54
SplunkTrust
SplunkTrust

An infinite number of times?

0 Karma

sloshburch
Splunk Employee
Splunk Employee

I think the question is how long do session keys persist before getting expired.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...