Splunk Dev

Splunk-Python (requests.get) outputs only first 100 events

vamsigurram
Path Finder

 

I wrote the below python code, which is giving me only first 100 events.

I checked online docs, i saw "count = 0" as a solution, to get all results, but that option only works for Splunk SDK (splunklib.client.service)

I am using python's requests library.

Need help in looping/pagination of all the results of this search id (%sid)

 

import requests
import json

url = base_url + "/services/search/jobs/%s/results" % sid
headers = {
"content-type": "application/x-www-form-urlencoded",
"Authorization": "Splunk %s" % sessionkey
}
payload = {

"output_mode": "json"

}
res = requests.get(url, headers=headers, params=payload, verify = False)
result = json.loads(res.text)["results"]

print("length is %s" % len(result)) =================> Output here is 100

 

 

Labels (1)
0 Karma
1 Solution

vamsigurram
Path Finder

As soon as i posted this question, i found the answer.

Its indeed count = 0 the answer, as highlighted below.
Been struggling with this for 2 days. But answer is so simple.

url = base_url + "/services/search/jobs/%s/results" % sid
headers = {
"content-type": "application/x-www-form-urlencoded",
"Authorization": "Splunk %s" % sessionkey
}
payload = {

"output_mode": "json",

"count": 0

}
res = requests.get(url, headers=headers, params=payload, verify = False)
result = json.loads(res.text)["results"]

print("length is %s" % len(result))

View solution in original post

0 Karma

vamsigurram
Path Finder

As soon as i posted this question, i found the answer.

Its indeed count = 0 the answer, as highlighted below.
Been struggling with this for 2 days. But answer is so simple.

url = base_url + "/services/search/jobs/%s/results" % sid
headers = {
"content-type": "application/x-www-form-urlencoded",
"Authorization": "Splunk %s" % sessionkey
}
payload = {

"output_mode": "json",

"count": 0

}
res = requests.get(url, headers=headers, params=payload, verify = False)
result = json.loads(res.text)["results"]

print("length is %s" % len(result))

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...