Splunk Dev

Using the Python SDK, why does my code return a list of saved searches that don't exist instead of a list saved searches I created?

metersk
Path Finder

I am trying to fetch all saved searches created by me with the Python SDK using the below code.

import splunklib.client as client

service = client.connect(host='xyz',
                         username='xyz',
                         password='xyz',
                         owner='xyz',
                         app='search')

savedsearches = service.saved_searches

for savedsearch in savedsearches:
    print savedsearch.name

The code returned a list of saved searches were not created by me, nor are they able to be found with in the GUI.

Any thoughts as to why this would return the names of saved searches that don't seem to exist?

In the docs there is a class called splunklib.client.Collection(service, path, item=)

Should I be using this instead?

0 Karma
1 Solution

rsennett_splunk
Splunk Employee
Splunk Employee

If you are seeing saved searches that don't exist... you most definitely have more than one instance of Splunk running.
You want to check here http://docs.splunk.com/DocumentationStatic/PythonSDK/1.3.0/binding.html#splunklib.binding.Context
because there are more options you can specify for client.connect()
the default management port setting is 8089, so if you haven't specified the port... that's what is being passed and that is not the management port for the instance you're trying to query.

I tested this, by implementing your script as is and filling in the 'xyz' as it pertains to my instance... and I got "unexpected" results too as I was seeing global saved searches that came from another instance (that I didn't even realize was running). So I tested further by changing the app= to an app I knew existed in the instance I was expecting to query and got "folder not found".

I changed the port to the alt management port I was using and I was now pointing at the proper instance.

Your code is fine. It's just not looking at the search head you think it should be...

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

rsennett_splunk
Splunk Employee
Splunk Employee

If you are seeing saved searches that don't exist... you most definitely have more than one instance of Splunk running.
You want to check here http://docs.splunk.com/DocumentationStatic/PythonSDK/1.3.0/binding.html#splunklib.binding.Context
because there are more options you can specify for client.connect()
the default management port setting is 8089, so if you haven't specified the port... that's what is being passed and that is not the management port for the instance you're trying to query.

I tested this, by implementing your script as is and filling in the 'xyz' as it pertains to my instance... and I got "unexpected" results too as I was seeing global saved searches that came from another instance (that I didn't even realize was running). So I tested further by changing the app= to an app I knew existed in the instance I was expecting to query and got "folder not found".

I changed the port to the alt management port I was using and I was now pointing at the proper instance.

Your code is fine. It's just not looking at the search head you think it should be...

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...