Splunk Dev

Python SDK Oneshot

dannyze
Explorer

Working with the Python SDK, and my end goal is to fetch logs over a given time.

For now I'm trying to output saved searches and then later will move on to the logs.
Referencing the docs, this is close to what I want to do, minus the delete portion

https://docs.splunk.com/DocumentationStatic/PythonSDK/1.6.5/client.html?highlight=saved%20searches#s...

Something like

for saved_search in saved_searches.iter(pagesize=10):
    print(saved_search)




but not getting any output, any ideas on where to go?

For clarity using the oneshot method, and want to output saved search results. 



Labels (2)
0 Karma

dannyze
Explorer

Thank you going through the documentation it seems like this would be it. However I am not getting any output. Are there more details about this API that can help  int his use case? 

 

0 Karma

dannyze
Explorer

Thank you going through the documentation it seems like this would be it. However I am not getting any output. Are there more details about this API that can help here? 

The following is the snippet that would perform listing of the saved search

  password = knox_auth(SPLUNK_PASSWORD)
    service = client.connect(host=HOST, port=PORT, username=USERNAME,
            password=password, basic=True, app=APP)
    # return service

    # Retrieve a search
    savedsearch = service.saved_searches["Saved Search"]
    job = savedsearch.dispatch()
    print(job.results())

 
Thank You

0 Karma

gaurav_maniar
Builder

Hi,

Please check the below documentation. I guess it will help with executing saved searches and displaying results.

Let me know if you need more details or help.

https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtowork/#To...

 

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...