Reporting

Splunk Enterprise 7.03 Python SDK Pagination Help

pdibenedetto
New Member

Good Morning,

I am working with:

Splunk Version
7.0.3
Splunk Build
fa31da744b51

I have built my search and when I run it in the dashboard, I see all 360 results that I am expecting; however, when I execute my saved search via the Python SDK I only get 100 results back. I believe it is related to pagination, but cannot figure out the correct parameters to solve the problem. Here is what I am running:

import splunklib.client as client
service = client.connect(
host=HOST,
port=PORT,
username=USERNAME,
password=PASSWORD)
...

            mysavedsearch = service.saved_searches[splunk_report]

            # Run the saved search
            job = mysavedsearch.dispatch()
     for result in results.ResultsReader(job.results()):

. .........process the response.

I see reference to count in other posts but mostly when executing a search not a saved_search. Any advice on what parameter to use would be appreciated.

Thanks.

0 Karma
1 Solution

damien_chillet
Builder

Hey,

Good news, the fix is very easy!
By default ResultsReader is limited to 100 raws, just add count=0 in job.results() arguments and you should get the whole thing!

for result in results.ResultsReader(job.results(count=0)):

View solution in original post

0 Karma

pdibenedetto
New Member

Thank you very much! That did the trick.

Pete

0 Karma

damien_chillet
Builder

Hey,

Good news, the fix is very easy!
By default ResultsReader is limited to 100 raws, just add count=0 in job.results() arguments and you should get the whole thing!

for result in results.ResultsReader(job.results(count=0)):
0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.3.2411?

Hey Splunky People! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2411. This release ...

Buttercup Games: Further Dashboarding Techniques (Part 6)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...