Splunk Dev

REST API Python example

bleung93
Path Finder

http://docs.splunk.com/Documentation/Splunk/6.1/RESTAPI/RESTsearches

I am testing out this script and it works with a few modifications on the endpoints I changed.

/services/search/jobs','POST'

I changed the endpoint to:

/services/search/jobs/%s/results' % (sid),'GET'

My results are great, but they appear in xml format. Would I have to add "output_mode=csv" in the body argument?

body=urllib.urlencode({'search': searchQuery}))[1]
0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

Damien_Dallimor
Ultra Champion

There is an example here :

http://docs.splunk.com/Documentation/Splunk/6.1.1/RESTAPI/RESTsearch#GET_search.2Fjobs.2F.7Bsearch_i...

Have you considered using the Splunk Python SDK , it makes what you are trying to do a lot simpler.

Some examples :

http://dev.splunk.com/view/python-sdk/SP-CAAAER5

bleung93
Path Finder

print httplib2.Http(disable_ssl_certificate_validation=True).request(base url +
+ '/services/search/jobs/%s/results' % (sid),'GET', headers={'Authorization': 'Splunk %s'
% sessionKey}, body=urllib.urlencode({'search': searchQuery}))[1]

The above will print out what this curl command would print out.

curl --get -k -u admin:splunker -d "count=100" https://localhost:8089/servicesNS/admin/search/search/jobs/1399938078.2/results

Where would I add content such as "output_mode=csv", that way the results being printed are user-friendly and easily readable?

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...