Reporting

Splunk Enterprise 7.03 Python SDK Pagination Help

pdibenedetto
New Member

Good Morning,

I am working with:

Splunk Version
7.0.3
Splunk Build
fa31da744b51

I have built my search and when I run it in the dashboard, I see all 360 results that I am expecting; however, when I execute my saved search via the Python SDK I only get 100 results back. I believe it is related to pagination, but cannot figure out the correct parameters to solve the problem. Here is what I am running:

import splunklib.client as client
service = client.connect(
host=HOST,
port=PORT,
username=USERNAME,
password=PASSWORD)
...

            mysavedsearch = service.saved_searches[splunk_report]

            # Run the saved search
            job = mysavedsearch.dispatch()
     for result in results.ResultsReader(job.results()):

. .........process the response.

I see reference to count in other posts but mostly when executing a search not a saved_search. Any advice on what parameter to use would be appreciated.

Thanks.

0 Karma
1 Solution

damien_chillet
Builder

Hey,

Good news, the fix is very easy!
By default ResultsReader is limited to 100 raws, just add count=0 in job.results() arguments and you should get the whole thing!

for result in results.ResultsReader(job.results(count=0)):

View solution in original post

0 Karma

pdibenedetto
New Member

Thank you very much! That did the trick.

Pete

0 Karma

damien_chillet
Builder

Hey,

Good news, the fix is very easy!
By default ResultsReader is limited to 100 raws, just add count=0 in job.results() arguments and you should get the whole thing!

for result in results.ResultsReader(job.results(count=0)):
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...