Splunk Search

Why am I getting no results returned using the Splunk Python SDK to search our Splunk instance?

rchoul
New Member

I'm using the Splunk Python SDK search our Splunk instance. However, I'm not getting any results.

Below is the code I'm using:

import sys
from time import sleep
import splunklib.client as client
import splunklib.results as results

count=0

HOST = "abc"
PORT = 8089
USERNAME = "user"
PASSWORD = "password"

service = client.connect(
    host=HOST,
    port=PORT,
    username=USERNAME,
    password=PASSWORD)

search_query = "search * | head 10"
kwargs_normalsearch = {"exec_mode": "normal"}

job = service.jobs.create(search_query, **kwargs_normalsearch)

while True:
    while not job.is_ready():
        pass
    stats = {"isDone": job["isDone"],
             "doneProgress": float(job["doneProgress"])*100,
              "scanCount": int(job["scanCount"]),
              "eventCount": int(job["eventCount"]),
              "resultCount": int(job["resultCount"])}

status = ("\r%(doneProgress)03.1f%%   %(scanCount)d scanned   "
          "%(eventCount)d matched   %(resultCount)d results") % stats

sys.stdout.write(status)
sys.stdout.flush()
if stats["isDone"] == "1":
    sys.stdout.write("\n\nDone!\n\n")
    break
sleep(2)

The connection is successful and I'm able to retrieve the list of apps but when I query it doesn't return any result. In fact, it says no result found. Below is the output I see when I run the query.

Connected Successfully

0.0% 0 scanned 0 matched 0 results
100.0% 0 scanned 0 matched 0 results

Done!

When I run this query i.e. 'search *' in the Web UI I do get results. I'm learning to use splunk and its python SDK so any help is immensely appreciated.

Thank you,
Regards

0 Karma

thomrs
Communicator

This works for me:

while True:
    job.refresh()
    if job["isDone"] == "1":
        print job["eventCount"]
        break
0 Karma

rchoul
New Member

I'm still getting 0 as the output. Could there be something wrong in my query itself?

Regards

0 Karma

thomrs
Communicator

Search looks right, if you add

print job["sid"]

you can get the job id and look it up under activity -> jobs.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...