splunk api slowness

[BalajiRaju]

The use case of mine is to retrieve the data from splunk. I have written the python script to get the data from splunk using splunk rest api. But it takes too much of time to process it and give the response. Tried oneshot method also but no use. Please guide me is there any other alternate approach to get the data from splunk. kindly suggest.

[marnall]

Are you using the API to dispatch and retrieve the results of a search? If so, does the search take roughly the same amount of time on its own?

[PickleRick]

With the level of vagueness in your question the only response is "something is wrong".

We don't know what your code looks like, we don't know your infrastructure, we don't know what results your script yields - both in terms of general return codes or errors from the whole script as well as any intermediate results.

It's hard to say anything with such little information.

[livehybrid]

Hi @BalajiRaju 

Please could you try two things to see if this gives us any further information on what might be happening here.

Please could you run the same search in both Splunk UI and via REST API and compare the runtimes for the same search. Please post the timing differences.

Also, try a very basic search via the API such as 

 | makeresults | eval msg="HelloWorld"

How long does the makeresults command take?

Are you using the Splunk Python SDK, if so, which version? 

Please feel free to post code snippets and searches to help us look into this further.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[BalajiRaju]

@livehybrid Thanks for your reply

I couldn't execute the splunk query in the splunk rest api using python script. Getting error message while executing the job. job has failed.

| makeresults | eval msg="HelloWorld"

 i can execute it on splunk UI. It takes "This search has completed and has returned 1 results by scanning 0 events in 0.302 seconds". I 

[livehybrid]

Please can you share the Python code you used to execute the test query so that we can help diagnose.

Thanks