Python SDK: Why do search results not contain keys for all fields?

[CraigAtNuna]

I'm retrieving DNS lookup log results from Splunk using the Python SDK. One of the fields present in the log is the domain. The search returns an OrderedDict for each entry, but looking at the keys in the dict some fields (like domain) are not present. The search string is simple: search index=dnslog | tail 1.

    blocksearch_results = splunk_job.results(**kwargs_paginate)

    for result in results.ResultsReader(blocksearch_results):
        print result['domain']  # Doesn't work - no such key

In Splunk Web, 'domain' is one of the 'interesting fields'. I can see the domain value as part of result['_raw'], but digging it out of there is not the right way to go.

How do I get the dict to contain key/value pairs for all fields?

[kbarker302 · Accepted solution]

You may need to use the fields option like this and explicitly name the fields you want:

search index=dnslog | fields domain field2 field3 | tail 1

I am not using the SDK, but I do have a Python script that executes a search using the REST API. If I don't specify fields, then I just get _raw in the response (I don't even get any interesting fields.) But I do get back as separate key/value pairs anything I ask for using fields.

[arkadyz1]

Did not work for me, alas. The reason might lie in the fact that all of the fields listed in my | fields pipe are aliased or calculated. Curiouser yet, I have this | fields <some field name>, <field name>, ... | fields -_rawfilter after my initial search, but the results don't have any of the fields while returning _raw just fine :(.

[CraigAtNuna]

That works! You should post this as the answer!

[kbarker302]

Thanks - actually, can you mark my comment as the answer? (There should be an option for that, maybe under the gear icon.)

[ppablo]

I converted for you 🙂 Cheers!

Patrick