I am creating a python script using Splunk SDK for Python to automate one of my tasks - update all savedsearches to run as 'fast' mode (instead of 'verbose' and 'smart')
This is where I'm at:
query = '| rest /servicesNS/-/-/saved/searches | where disabled=0 | search "display.page.search.mode"!="fast" "eai:acl.app"!="splunk_archiver" "eai:acl.app"!="splunk_monitoring_console" "eai:acl.app"!="splunk_instrumentation" "eai:acl.owner"!="nobody" | table title cron_schedule eai:acl.owner actions eai:acl.app action.email.message.alert action.email.to action.email.cc search updated description display.page.search.mode'
service = client.connect(
host='<my_splunk_search_head_url>',
port=443,
scheme='https',
verify=False,
autologin=True,
token=token,
)
job = service.search(query=query, output_mode='json')
total_elapsed_time = 0
while not job.is_done():
sleep(.2)
total_elapsed_time += 0.2
print(f"Job is {job.is_done()} after {total_elapsed_time} secs")
list_rule_not_running_fast_mode = []
rr = results.JSONResultsReader(job.results(output_mode='json'))
for result in rr:
if isinstance(result, results.Message):
print(f'{result.type}: {result.message}')
elif isinstance(result, dict):
print(result['title'])
list_rule_not_running_fast_mode.append(result['title'])
all_saved_searchs = service.saved_searches
The query could return all the savedsearches not running in 'fast' mode, however, the service.saved_searches list could not find all the returned savedsearch names.
So in short, the problem is, service.saved_searches does not contain all of my savedsearches.
What am I missing here?
