Getting Data In

How many times it executes splunk search and export using python rest api ?

poorni_p
Explorer

Hi all,
I am writing a python rest api script to search and export csv results to a location.
I got the session key for the below query.

     serviceContent=httplib2.Http.request(...)
     sessionkey = minidom.parseString(serviceContent).getElementsByTagName('sessionKey')[0].childNodes[0].nodeValue

And using this session key, i am writing a infinite while loop to execute search and import csv file

  while true:
           ...
         #splunk Search using the Session key and got job id here
         #Get results & Export to CSV statement here
         #time.sleep(60) statement here to run the search every minute
         ...

My query is how many times the while look will get executed with the Session key?

thanks in advance.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

I can't validate this but I wonder if it would be defined by the sessionTimeout property of server.conf

[general]
sessionTimeout = <nonnegative integer>[s|m|h|d]
* The amount of time before a user session times out, expressed as a
  search-like time range.
* Examples include "24h" (24 hours), "3d" (3 days),
  "7200s" (7200 seconds, or two hours)
* Default: "1" (1 hour)

So if the session is active then it may never expire because I believe this is more about inactive sessions.

0 Karma

poorni_p
Explorer

@SloshBurch
Not sure about server.conf, but i guess this can be defined in Settings in the upper right-hand corner -> Server settings -> Click General settings -> Session timeout.

any thoughts ?

0 Karma

sloshburch
Splunk Employee
Splunk Employee

I believe we're talking about the same thing. I mentioned where it is in the conf file and I think you found where it is in the UI. Let's see if I can get some developers to peek at this as well.

0 Karma

jkat54
SplunkTrust
SplunkTrust

An infinite number of times?

0 Karma

sloshburch
Splunk Employee
Splunk Employee

I think the question is how long do session keys persist before getting expired.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...