Splunk Dev

Script python with search SPL

wcastillocruz
Path Finder

Hello Splunk team,

do you know if it's possible to do a splunk search in a python script? taking into account the selection of the desired period (last week, last month ...).

for example for a simple search :

| append [search sourcetype=ESP_Histo env="Web" service="Application" apps="Web Sharepoints" fn="*" managed_entity="*- URL" sampler="SHAREPOINT - URL" ID_EVENT | eval Applications=case( apps like "%Web Sharepoints%","WEB SHAREPOINTS") | `transactions` ]

| eval max_time=if(info_max_time == "+Infinity", now(), info_max_time) | eval min_time=if(info_min_time == "0.000", 1577836800, info_min_time) | eval periode1=max_time-min_time
| stats sum(duration) AS durationindispo by Applications, periode1

| outputcsv append=true override_if_empty=false web_search

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, it's possible to perform a search in a Python script.  See https://docs.splunk.com/Documentation/Splunk/8.2.2/RESTREF/RESTsearch for the details.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Yes, it's possible to perform a search in a Python script.  See https://docs.splunk.com/Documentation/Splunk/8.2.2/RESTREF/RESTsearch for the details.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...