REST API Python example

[bleung93]

http://docs.splunk.com/Documentation/Splunk/6.1/RESTAPI/RESTsearches

I am testing out this script and it works with a few modifications on the endpoints I changed.

/services/search/jobs','POST'

I changed the endpoint to:

/services/search/jobs/%s/results' % (sid),'GET'

My results are great, but they appear in xml format. Would I have to add "output_mode=csv" in the body argument?

body=urllib.urlencode({'search': searchQuery}))[1]

[Damien_Dallimor · Accepted solution]

There is an example here :

http://docs.splunk.com/Documentation/Splunk/6.1.1/RESTAPI/RESTsearch#GET_search.2Fjobs.2F.7Bsearch_i...

Have you considered using the Splunk Python SDK , it makes what you are trying to do a lot simpler.

Some examples :

http://dev.splunk.com/view/python-sdk/SP-CAAAER5

[bleung93]

print httplib2.Http(disable_ssl_certificate_validation=True).request(base url +
+ '/services/search/jobs/%s/results' % (sid),'GET', headers={'Authorization': 'Splunk %s'
% sessionKey}, body=urllib.urlencode({'search': searchQuery}))[1]

The above will print out what this curl command would print out.

curl --get -k -u admin:splunker -d "count=100" https://localhost:8089/servicesNS/admin/search/search/jobs/1399938078.2/results

Where would I add content such as "output_mode=csv", that way the results being printed are user-friendly and easily readable?