Splunk Search

Regular search for all results

lemon_wire
Engager

Hi,
I am using the Splunk API (with Python) to pull all values of a given record from a given index. I would like to download all data on a regular basis.

What strategy should I use to ensure I get all records without duplication and without missing anything? For instance, in a traditional DB world I might use a unique index value to keep track.

For example I would like to run this every hour to get all records:
"search index=syslog ssh* | table _raw"

Should I use some 'time' condition or is there some sort of count or index I could use?

Thanks

0 Karma

chris
Motivator

You might be able to achieve what you want by triggering a real time search.

Since you are using the Python you know or are using the python SDK right?

I would probably use the stail.py script as a starting point:

http://dev.splunk.com/view/SP-CAAAEFK#stail

https://github.com/splunk/splunk-sdk-python/blob/master/examples/stail.py

Chris

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...