I need to call a saved search using resultsReader class using the python splunk sdk. The result set of the saved search is greater than 50K events. I might not be using correctly the API or there is a bug in the API. The problem I am facing is that after some events are returned I am getting the following exception in results.py. Traceback (most recent call last): File "mysavedsearch.py", line 64, in <module> for re in results.ResultsReader(blocksearch_results): File "/opt/splunk/bin/scripts/splunk-sdk-python-1.2.2/examples/../splunklib/results.py", line 205, in next return self._gen.next() File "/opt/splunk/bin/scripts/splunk-sdk-python-1.2.2/examples/../splunklib/results.py", line 258, in _parse_results except et.ParseError as pe: AttributeError: 'module' object has no attribute 'ParseError' This is my code: import urllib2,sys,csv,results,json from time import sleep import splunklib.client as client import splunklib.results as results HOST = "hello.com" PORT = 8089 USERNAME = "user_id" PASSWORD = "mypwd" OWNER = "owner" APP = "appname" # Create a Service instance and log in service = client.connect( host=HOST, port=PORT, username=USERNAME, password=PASSWORD, app=APP, owner=OWNER) mysavedsearch = service.saved_searches["saved_search_name"] # Run the saved search job = mysavedsearch.dispatch() # Wait for the job to finish while True: job.refresh() stats = {"isDone": job["isDone"], "doneProgress": float(job["doneProgress"])*100, "scanCount": int(job["scanCount"]), "eventCount": int(job["eventCount"]), "resultCount": int(job["resultCount"])} status = ("\r%(doneProgress)03.1f%% %(scanCount)d scanned " "%(eventCount)d matched %(resultCount)d results") % stats if stats["isDone"] == "1": break count = 100 offset = 0 while (offset < int(resultCount)): kwargs_paginate = {"count": count, "offset": offset} # Get the search results blocksearch_results = job.results(**kwargs_paginate) for re in results.ResultsReader(blocksearch_results): print re # Increase the offset to get the next set of results offset += count job.cancel() Thanks, Lp Note: The issue has been fixed in the next Python SDK version. ... View more

After upgrading to Splunk 6.X all our python scripts that use the latest version of splunk sdk “splunk-sdk-python-1.2.2” stop working. The error we constantly get is the following: ssl.SSLError: [Errno 1] _ssl.c:492: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol Has anyone faced this issue? How did you solve it? These are the connection parameters we used. HOST = "myhost.com" PORT = 8089 USERNAME = "myaccountid" PASSWORD = "mypassword" OWNER = "myaccountid" APP = "search" # Create a Service instance and log in service = client.connect( host=HOST, port=PORT, username=USERNAME, password=PASSWORD, app=APP, owner=OWNER, ) After a couple of tests and reading the splunk sdk API. I realized that https scheme is the default in splunklib.client.connect. However, after the upgrade it looks like the splunk admin disabled the support of https. So the issue was solved as follow: HOST = "myhost.com" PORT = 8089 USERNAME = "myaccountid" PASSWORD = "mypassword" OWNER = "myaccountid" SCHEME = "http" APP = "search" # Create a Service instance and log in service = client.connect( host=HOST, port=PORT, username=USERNAME, password=PASSWORD, app=APP, owner=OWNER, scheme=SCHEME ) ... View more

The same query was run in two master heads. These are the results: Response time from master head Splunk 5.0.2: This search has completed and has returned 12 results by scanning 41,283 events in 11.072seconds. -> 9.604 seconds dispatch.stream.remote Response time from master head splunk 6.0.1: This search has completed and has returned 12 results by scanning 41,283 events in208.412 seconds. 200.562 dispatch.finalizeRemoteTimeline The same behavior across all splunk 6.0.1 master head but not in splunk 5.0.2 master head. Is there anyone in the forum with the same problem? Any idea? Lp ... View more

Any idea about this event in splunkd.log? 02-17-2014 17:36:12.384 +0000 WARN LMTracker - skipping directive, reason='found invalid directive cmd='D_set_active_group' args=[Enterprise,,] argsize=3' Thanks, Lp ... View more

Splunkd stop responding after the event presented below. Splunk Tech. Support filed a bug against Splunk Enterprise version 6.0.1. 02-12-2014 13:59:01.768 +0000 ERROR AdminManager - Stack trace from python handler:\nTraceback (most recent call last):\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 70, in init\n hand.execute(info)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/admin.py", line 527, in execute\n if self.requestedAction == ACTION_LIST: self.handleList(confInfo)\n File "/opt/splunk/etc/system/bin/DataModelAccelerationHandler.py", line 20, in handleList\n sc_rest.BaseRestHandler.handleList(self, confInfo)\n File "/opt/splunk/etc/system/bin/sc_rest.py", line 74, in handleList\n ent = self.all()\n File "/opt/splunk/etc/system/bin/sc_rest.py", line 221, in all\n offset=self.posOffset)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 129, in getEntities\n atomFeed = _getEntitiesAtomFeed(entityPath, namespace, owner, search, count, offset, sort_key, sort_dir, sessionKey, uri, hostPath, **kwargs)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/entity.py", line 222, in _getEntitiesAtomFeed\n serverResponse, serverContent = rest.simpleRequest(uri, getargs=kwargs, sessionKey=sessionKey, raiseAllErrors=True)\n File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 469, in simpleRequest\n raise splunk.SplunkdConnectionException, 'Error connecting to %s: %s' % (path, str(e))\nSplunkdConnectionException: Splunkd daemon is not responding: ('Error connecting to /servicesNS/-/-/data/models: _ssl.c:506: The handshake operation timed out',)\n This issue was identified as deadlock bug in openssl. ... View more

I have a set of custom search commands that are working fine but I need splunk.Intersplunk.outputResults to return the results is a determined order. Any idea: How can I force "splunk.Intersplunk.outputResults" to return the results in a determined order? Thanks, Lp ... View more