I'm using the Splunk Python SDK search our Splunk instance. However, I'm not getting any results.
Below is the code I'm using:
import sys
from time import sleep
import splunklib.client as client
import splunklib.results as results
count=0
HOST = "abc"
PORT = 8089
USERNAME = "user"
PASSWORD = "password"
service = client.connect(
host=HOST,
port=PORT,
username=USERNAME,
password=PASSWORD)
search_query = "search * | head 10"
kwargs_normalsearch = {"exec_mode": "normal"}
job = service.jobs.create(search_query, **kwargs_normalsearch)
while True:
while not job.is_ready():
pass
stats = {"isDone": job["isDone"],
"doneProgress": float(job["doneProgress"])*100,
"scanCount": int(job["scanCount"]),
"eventCount": int(job["eventCount"]),
"resultCount": int(job["resultCount"])}
status = ("\r%(doneProgress)03.1f%% %(scanCount)d scanned "
"%(eventCount)d matched %(resultCount)d results") % stats
sys.stdout.write(status)
sys.stdout.flush()
if stats["isDone"] == "1":
sys.stdout.write("\n\nDone!\n\n")
break
sleep(2)
The connection is successful and I'm able to retrieve the list of apps but when I query it doesn't return any result. In fact, it says no result found. Below is the output I see when I run the query.
Connected Successfully
0.0% 0 scanned 0 matched 0 results
100.0% 0 scanned 0 matched 0 resultsDone!
When I run this query i.e. 'search *' in the Web UI I do get results. I'm learning to use splunk and its python SDK so any help is immensely appreciated.
Thank you,
Regards
This works for me:
while True:
job.refresh()
if job["isDone"] == "1":
print job["eventCount"]
break
I'm still getting 0 as the output. Could there be something wrong in my query itself?
Regards
Search looks right, if you add
print job["sid"]
you can get the job id and look it up under activity -> jobs.