Splunk Search

How can I not to iterate ResultsReader if I want to return results to Splunk. Python SDK.

Explorer

This is a part of custom search command (EventingCommand) fro example. I get some input events and start jobs based on them.

def transform(self, events):

        event = events.next()
        search = getSearchFromEvent(event)
        job = self.service.jobs.create(search)

        while not job.is_done():
        reader = results.ResultsReader(job.results(count = 0))
        for line in reader:
                yield line

Is it possible to skip iteration and return results as generator or something like without this circle?

0 Karma

Champion

This may help. Refer "To display results without a reader" in below doc:
http://dev.splunk.com/view/python-sdk/SP-CAAAER5

0 Karma

Explorer

Thanks for attention! I meant I don't want make transfer of result data through my search command at all.

P.S. I'll try if this gives performance benefits and add info here.

0 Karma