When I used the following code to perform a query: service = client.connect( host= 'splunk.bart.gov', port = '8089', username = 'userid', password = 'secrete', ) query = "search index=slog_ics...
See more...
When I used the following code to perform a query: service = client.connect( host= 'splunk.bart.gov', port = '8089', username = 'userid', password = 'secrete', ) query = "search index=slog_ics sourcetype=occ_mgr | table _time, ENTRY | head 3"
query_results = service.jobs.oneshot(query)
reader = res.ResultsReader(query_results)
results = []
for item in reader:
print(item)
results.append(item)
print("results[1]:")
print(results[1]) In the above result, I cannot see the value for the field ENTRY. ENTRY is a field defined by the sourcetype occ_mgr in my application ics_analytics. While in Splunk web UI, in the context of the application ics_analytics using the same query, I can see the field value of ENTRY: index=slog_ics sourcetype=occ_mgr | fields _time, ENTRY | head 3 with the result: _time ENTRY
4/6/22 2:11:00.000 AM EOR.
4/6/22 1:48:00.000 AM (ref 0120) T203 released ATO, (762) second delay.
4/6/22 1:36:00.000 AM CORE Blanket established. What could be the root cause of the problem?