- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Python script to read Splunk data
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
First, I don't see any valid search result with print(result) statement. My key question is how to define search string for https://splunk.usce.l.az.fisv.cloud/en-US/app/epayments/postpayee_success_and_failure?form.SponsorId=*&form.SubscriberId=*&form.CorrelationId=*&form.Status=*&form.Exception=-&form.timespan.earliest=-7d%40h&form.timespan.latest=now after Splunk client connection? Second, I don't see Splunk website login example in your link?
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


You don't get any results back because of the error 401, which indicates an authentication failure. Fixing the search query will not change that.
Authentication is done by the client.connect call. Carefully compare your code to that in the examples at dev.splunk.com.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry, I replied to your previous response. Here you go again:
Sorry for the confusion. I am trying with 2 different approaches with the same login credentials. The 1st one is regular Web access with failed 401 error and the 2nd one is connection via Splunk-SDK client which is successful. It is confirmed with <splunklib.client.Service object at 0x0000013682881790> for print(service) statement. For my 1st Web access connection, my question is how to login Spunk website correctly. For my 2nd Splunk client connection, my question is how to modify its "search" string to get correct results. I am fine with either one.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


I think that rather than the job.export command, you want job.results command. See https://docs.splunk.com/Documentation/Splunk/8.2.2/RESTREF/RESTsearch#search.2Fjobs.2F.7Bsearch_id.7...
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My application developer gives me correct Splunk search string (see below), but its output is in
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


The SDK lets you choose the output format. See https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtodisplays...
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I tried both rr = results.ResultsReader(service.jobs.export(SEARCH_STRING, **{"output_mode": "CSV"})) and rr = results.ResultsReader(service.jobs.export(SEARCH_STRING, output_mode="CSV")). Both give me the following invalid format CSV error:
I also tried to add "|outputcsv myoutput.csv" inside my SEARCH_STRING, I don't know where is its location on Windows Server 2016?
By the way, your document is pretty hard to understand. Do you mind to give me direct answer next time?
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The key question is that the default output in <class 'collections.OrderedDict'> format is ugly and hard to convert to pandas dataframe. The output in CSV format is much easier to load into dataframe. If there is new way to convert output to dataframe, I don't mind what output format it is.
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Don't worry, I found a way to load OrderedDict data into dataframe.
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


None of the DEBUG messages shown indicate a problem with the search query. Two of them refer to errors in a props.conf file ("Invalid eval expression") and the others are just informational. What leads you to believe there's something wrong with the query?
The error 401 indicates you're not passing your login credentials correctly. See https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtoconnectp...for assistance.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry for the confusion. I am trying with 2 different approaches with the same login credentials. The 1st one is regular Web access with failed 401 error and the 2nd one is connection via Splunk-SDK client which is successful. It is confirmed with <splunklib.client.Service object at 0x0000013682881790> for print(service) statement. For my 1st Web access connection, my question is how to login Spunk website correctly. For my 2nd Splunk client connection, my question is how to modify its "search" string to get correct results. I am fine with either one.
