Splunk Dev

Splunk-Python (requests.get) outputs only first 100 events

vamsigurram
Path Finder

 

I wrote the below python code, which is giving me only first 100 events.

I checked online docs, i saw "count = 0" as a solution, to get all results, but that option only works for Splunk SDK (splunklib.client.service)

I am using python's requests library.

Need help in looping/pagination of all the results of this search id (%sid)

 

import requests
import json

url = base_url + "/services/search/jobs/%s/results" % sid
headers = {
"content-type": "application/x-www-form-urlencoded",
"Authorization": "Splunk %s" % sessionkey
}
payload = {

"output_mode": "json"

}
res = requests.get(url, headers=headers, params=payload, verify = False)
result = json.loads(res.text)["results"]

print("length is %s" % len(result)) =================> Output here is 100

 

 

Labels (1)
0 Karma
1 Solution

vamsigurram
Path Finder

As soon as i posted this question, i found the answer.

Its indeed count = 0 the answer, as highlighted below.
Been struggling with this for 2 days. But answer is so simple.

url = base_url + "/services/search/jobs/%s/results" % sid
headers = {
"content-type": "application/x-www-form-urlencoded",
"Authorization": "Splunk %s" % sessionkey
}
payload = {

"output_mode": "json",

"count": 0

}
res = requests.get(url, headers=headers, params=payload, verify = False)
result = json.loads(res.text)["results"]

print("length is %s" % len(result))

View solution in original post

0 Karma

vamsigurram
Path Finder

As soon as i posted this question, i found the answer.

Its indeed count = 0 the answer, as highlighted below.
Been struggling with this for 2 days. But answer is so simple.

url = base_url + "/services/search/jobs/%s/results" % sid
headers = {
"content-type": "application/x-www-form-urlencoded",
"Authorization": "Splunk %s" % sessionkey
}
payload = {

"output_mode": "json",

"count": 0

}
res = requests.get(url, headers=headers, params=payload, verify = False)
result = json.loads(res.text)["results"]

print("length is %s" % len(result))

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...