Splunk Dev

python sdk and realtime search?

bfaber
Communicator

I am trying to get realtime streaming results using the python sdk. The code I was using looks like this:

auth.getSessionKey('admin','changeme')
args = {"earliestTime": 0, "latestTime": 0}
job = search.dispatch(' search *',**args)

for event in job:
  print  event['_raw']

print search
job.cancel()

No errors, but no results either. What am I doing wrong?

Tags (2)
1 Solution

bfaber
Communicator

Using the Job Inspector, I was able to reverse the kwargs...

args = {'time_format': '%s.%Q', 'search': 'search *', 'required_field_list': '*', 'max_count': '10000', 'ui_dispatch_app': 'search', 'latest_time': 'rt', 'status_buckets': '300', 'ui_dispatch_view': 'flashtimeline', 'earliest_time': 'rt-1m', 'auto_cancel': '100'}

This changes the search line to be:

job = search.dispatch(**args)

This all seems to work, but is probably more complex than needed.

View solution in original post

psanford_splunk
Splunk Employee
Splunk Employee

There is also a new Splunk Python SDK on GitHub. You can access it here: https://github.com/splunk/splunk-sdk-python

There are a number of search examples in the SDK.

Any questions - psanford@splunk.com or ping us on Twitter: @splunkdev

0 Karma

bfaber
Communicator

Using the Job Inspector, I was able to reverse the kwargs...

args = {'time_format': '%s.%Q', 'search': 'search *', 'required_field_list': '*', 'max_count': '10000', 'ui_dispatch_app': 'search', 'latest_time': 'rt', 'status_buckets': '300', 'ui_dispatch_view': 'flashtimeline', 'earliest_time': 'rt-1m', 'auto_cancel': '100'}

This changes the search line to be:

job = search.dispatch(**args)

This all seems to work, but is probably more complex than needed.

Lowell
Super Champion

Have you tried adding rt to your earliest/lastest times?

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...