Splunk Dev

Truncated _raw field with Python SDK

bradp123
Path Finder

Hello,

I am following the python SDK examples to pull data from a job. Here is my search code:


...
searchquery_normal = "search block | head 20"
job = service.jobs.create(searchquery_normal)
...
for result in results.ResultsReader(job.results()):
print result["_raw"]

When I get the results back I am only getting a portion of the text in the raw field. In the GUI I get the full log text, in the SDK the text truncates after the work "block". Is this normal Splunk behavior? How do I get the full line of text?

Tags (2)
0 Karma

bradp123
Path Finder
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...