Splunk Search

Python SDK: Why do search results not contain keys for all fields?

CraigAtNuna
Explorer

I'm retrieving DNS lookup log results from Splunk using the Python SDK. One of the fields present in the log is the domain. The search returns an OrderedDict for each entry, but looking at the keys in the dict some fields (like domain) are not present. The search string is simple: search index=dnslog | tail 1.

    blocksearch_results = splunk_job.results(**kwargs_paginate)

    for result in results.ResultsReader(blocksearch_results):
        print result['domain']  # Doesn't work - no such key

In Splunk Web, 'domain' is one of the 'interesting fields'. I can see the domain value as part of result['_raw'], but digging it out of there is not the right way to go.

How do I get the dict to contain key/value pairs for all fields?

0 Karma
1 Solution

kbarker302
Communicator

You may need to use the fields option like this and explicitly name the fields you want:

search index=dnslog | fields domain field2 field3 | tail 1

I am not using the SDK, but I do have a Python script that executes a search using the REST API. If I don't specify fields, then I just get _raw in the response (I don't even get any interesting fields.) But I do get back as separate key/value pairs anything I ask for using fields.

View solution in original post

kbarker302
Communicator

You may need to use the fields option like this and explicitly name the fields you want:

search index=dnslog | fields domain field2 field3 | tail 1

I am not using the SDK, but I do have a Python script that executes a search using the REST API. If I don't specify fields, then I just get _raw in the response (I don't even get any interesting fields.) But I do get back as separate key/value pairs anything I ask for using fields.

arkadyz1
Builder

Did not work for me, alas. The reason might lie in the fact that all of the fields listed in my | fields pipe are aliased or calculated. Curiouser yet, I have this | fields <some field name>, <field name>, ... | fields -_rawfilter after my initial search, but the results don't have any of the fields while returning _raw just fine :(.

0 Karma

CraigAtNuna
Explorer

That works! You should post this as the answer!

kbarker302
Communicator

Thanks - actually, can you mark my comment as the answer? (There should be an option for that, maybe under the gear icon.)

0 Karma

ppablo
Retired

I converted for you 🙂 Cheers!

Patrick

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...