Splunk Dev

Script python with search SPL

wcastillocruz
Path Finder

Hello Splunk team,

do you know if it's possible to do a splunk search in a python script? taking into account the selection of the desired period (last week, last month ...).

for example for a simple search :

| append [search sourcetype=ESP_Histo env="Web" service="Application" apps="Web Sharepoints" fn="*" managed_entity="*- URL" sampler="SHAREPOINT - URL" ID_EVENT | eval Applications=case( apps like "%Web Sharepoints%","WEB SHAREPOINTS") | `transactions` ]

| eval max_time=if(info_max_time == "+Infinity", now(), info_max_time) | eval min_time=if(info_min_time == "0.000", 1577836800, info_min_time) | eval periode1=max_time-min_time
| stats sum(duration) AS durationindispo by Applications, periode1

| outputcsv append=true override_if_empty=false web_search

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, it's possible to perform a search in a Python script.  See https://docs.splunk.com/Documentation/Splunk/8.2.2/RESTREF/RESTsearch for the details.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Yes, it's possible to perform a search in a Python script.  See https://docs.splunk.com/Documentation/Splunk/8.2.2/RESTREF/RESTsearch for the details.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...