Splunk Enterprise

Python SDK Saved Search Variable Passing

caden00
Observer

I am using Python to access and saved search. I want to then run this saved search.  I understand how to do this using the .dispatch method. The issue I am having is that I have a search with search variables, for example

| eval state="$state$"

Using SPL I simply call

| savedsearch "somesearch" state="state"

In Python I have seen with JS you can pass

{state: somestate}

in the .dispatch() method.

In Python however, any time I attempt to pass a parameter with these values I get various errors. Any help in the direction of passing a variable name would be great!

Thanks

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@caden00 

Have you tried this?

 

kwargs = {"state": "state"}
job = mysavedsearch.dispatch(**kwargs)

 

 

KV 

0 Karma

caden00
Observer

Passing this returns that the value "state" is not supported by this handler.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@caden00 

Can you please try this?

kwargs = {"args.state": "state"}
job = mysavedsearch.dispatch(**kwargs)

KV 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...