Splunk Dev

Fields defined by a sourcetype not being shown in query results by Splunk SDK?

yshen
Communicator

When I used the following code to perform a query:

service = client.connect(
host= 'splunk.bart.gov',
port = '8089',
username = 'userid',
password = 'secrete',
)

query = "search index=slog_ics sourcetype=occ_mgr  | table _time, ENTRY | head 3"
query_results = service.jobs.oneshot(query)
reader = res.ResultsReader(query_results)
results = []
for item in reader:
    print(item)
    results.append(item)
print("results[1]:")
print(results[1])

In the above result, I cannot see the value for the field ENTRY.

ENTRY is a field defined by the sourcetype occ_mgr in my application ics_analytics.

While in Splunk web UI, in the context of the application ics_analytics using the same query, I can see the field value of ENTRY:

index=slog_ics sourcetype=occ_mgr  | fields _time, ENTRY  | head 3

with the result:

	_time ENTRY
4/6/22 2:11:00.000 AM EOR.
4/6/22 1:48:00.000 AM (ref 0120) T203 released ATO, (762) second delay.
4/6/22 1:36:00.000 AM CORE Blanket established.

What could be the root cause of the problem?

 

 
 
 
 
Labels (2)
Tags (2)
0 Karma

yshen
Communicator

With hint by https://splunk-usergroups.slack.com/team/UB5DA9L02, it turns out that as the sourcetype is only known in the context of my application ics_analytics, in the service definition with SDK, I must indicate the application context with app= argument. Here is the corrected service definition:

 

service = client.connect(
host= 'splunk.bart.gov',
app='ics_analysis',
port = '8089',
username = 'userid',
password = 'secrete',
)

 

once the sourcetype is properly declared to be known, the same code as above would be able to retrieve the field value of ENTRY.

Here is the link to the relevant documentation:
https://docs.splunk.com/DocumentationStatic/PythonSDK/1.6.16/client.html#splunklib.client.Service

This is post is a capture of Slack discussion:
https://splunk-usergroups.slack.com/archives/C04DC8JJ6/p1649351828984919?thread_ts=1649265592.685629...

 

 

 
 
Tags (2)
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...