Reporting

Splunk Enterprise 7.03 Python SDK Pagination Help

pdibenedetto
New Member

Good Morning,

I am working with:

Splunk Version
7.0.3
Splunk Build
fa31da744b51

I have built my search and when I run it in the dashboard, I see all 360 results that I am expecting; however, when I execute my saved search via the Python SDK I only get 100 results back. I believe it is related to pagination, but cannot figure out the correct parameters to solve the problem. Here is what I am running:

import splunklib.client as client
service = client.connect(
host=HOST,
port=PORT,
username=USERNAME,
password=PASSWORD)
...

            mysavedsearch = service.saved_searches[splunk_report]

            # Run the saved search
            job = mysavedsearch.dispatch()
     for result in results.ResultsReader(job.results()):

. .........process the response.

I see reference to count in other posts but mostly when executing a search not a saved_search. Any advice on what parameter to use would be appreciated.

Thanks.

0 Karma
1 Solution

damien_chillet
Builder

Hey,

Good news, the fix is very easy!
By default ResultsReader is limited to 100 raws, just add count=0 in job.results() arguments and you should get the whole thing!

for result in results.ResultsReader(job.results(count=0)):

View solution in original post

0 Karma

pdibenedetto
New Member

Thank you very much! That did the trick.

Pete

0 Karma

damien_chillet
Builder

Hey,

Good news, the fix is very easy!
By default ResultsReader is limited to 100 raws, just add count=0 in job.results() arguments and you should get the whole thing!

for result in results.ResultsReader(job.results(count=0)):
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...