Splunk Enterprise

Python SDK Saved Search Variable Passing

caden00
Observer

I am using Python to access and saved search. I want to then run this saved search.  I understand how to do this using the .dispatch method. The issue I am having is that I have a search with search variables, for example

| eval state="$state$"

Using SPL I simply call

| savedsearch "somesearch" state="state"

In Python I have seen with JS you can pass

{state: somestate}

in the .dispatch() method.

In Python however, any time I attempt to pass a parameter with these values I get various errors. Any help in the direction of passing a variable name would be great!

Thanks

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@caden00 

Have you tried this?

 

kwargs = {"state": "state"}
job = mysavedsearch.dispatch(**kwargs)

 

 

KV 

0 Karma

caden00
Observer

Passing this returns that the value "state" is not supported by this handler.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@caden00 

Can you please try this?

kwargs = {"args.state": "state"}
job = mysavedsearch.dispatch(**kwargs)

KV 

0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...