Also I am facing another issue. The below code is just bringing 102 records however if download form the tool there 4000+ records           service = client.connect(host=HOST, port=PORT, username=USERNAME, password=PASSWORD)             kwargs_oneshot = {"earliest_time": "-24h","latest_time": "now","search_mode": "normal", "output_mode": "csv"}             searchquery_oneshot = r'search index=adms RestLoggingUtil FeatureChangeInitiated "/billing/v1/update-soc" |rex "billingAccountId  \":\"(?<BAN>\d+)"| eval PAYLOAD=trim(PAYLOAD,"[] ") | spath input=PAYLOAD |  table socClassifVvCode, logicalDate, billingAccountId, msisdn'             oneshotsearch_results = service.jobs.oneshot(searchquery_oneshot, **kwargs_oneshot)         except Exception as e:             print("Reason:", e)         print('Fething results from splunk server - please wait for response codes/error messages...')         reader = results.ResultsReader(oneshotsearch_results)         file = "REDD_SOC_ScreenLimits_" + currentDT.strftime("%Y%m%d%H%M%S") + ".csv"         f = open(file, 'wb')         f.write(oneshotsearch_results.read())         f.close()         print("Data Download Completed")     Not sure what am I missing ... View more

Thanks this did worked. however if I have to download the logs from my python code how can I use this date range option?   currently I am doing this: service = client.connect(host=HOST, port=PORT, username=USERNAME, password=PASSWORD)             kwargs_oneshot = {"earliest_time": "-60min","latest_time": "now","search_mode": "normal", "output_mode": "csv"}   and planning to extend it to -24H but is it possible to provide a date range here?   Thanks and Regards, Avanti ... View more

Hi  Thanks for your response. Here is my sample search query: index=adms RestLoggingUtil XXXXXXXXXXXXXX "/billing/v1/update-soc" |rex "billingAccountId \":\"(?<BAN>\d+)"| spath input=PAYLOAD | table socClassifVvCode, billingAccountId The output of the search is payload data hence I mentioned payload in my earlier post. so the time picker should be part of my search query correct? Just wanted to confirm before trying it.   Thanks for your help! Thanks  Avanti   ... View more

Hello Team,   Need help with one more thing, is it possible to retrieve the data from SPLUNK search from a date? For e.g if I need the payload logs from April is it possible to download them?   Thanks for all your help!   Thanks and Regards, Avanti ... View more

Thanks a bunch to both of you for helping me on this one. It really makes it easy for me in this format. My next plan is to update my python code to directly insert this data in the table. If you have any other suggestions, please let me know.   Once again Thanks a bunch for all your help!   Thanks  Avanti ... View more

Here is my updated query; index=adms RestLoggingUtil XXXXXXXXXXXXXX "/billing/v1/update-soc" |rex "billingAccountId \":\"(?<BAN>\d+)"| spath input=PAYLOAD | table socClassifVvCode, billingAccountId     and also getting following error 5 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors. Unknown error for indexer: prdtlplnk0113. Search Results might be incomplete! If this occurs frequently, check on the peer. Unknown error for indexer: prdtlplnk0117. Search Results might be incomplete! If this occurs frequently, check on the peer. Unknown error for indexer: prdtlplnk0132. Search Results might be incomplete! If this occurs frequently, check on the peer. [prdplplnk0155] Error in 'DispatchCommandProcessor': Search results may be incomplete, peer prdplplnk0155's search ended prematurely. Error = Peer prdplplnk0155 will not return any results for this search, because the search head is using an outdated generation (search head gen_id=6093030; peer gen_id=6093032). This can be caused by the peer re-registering and the search head not yet updating to the latest generation. This should resolve itself shortly. [prdplplnk016d] Error in 'DispatchCommandProcessor': Search results may be incomplete, peer prdplplnk016d's search ended prematurely. Error = Peer prdplplnk016d will not return any results for this search, because the search head is using an outdated generation (search head gen_id=6093030; peer gen_id=6093036). This can be caused by the peer re-registering and the search head not yet updating to the latest generation. This should resolve itself shortly   Original search and output:   Hope this helps. and Appreciate all your inputs and help!   Thanks  Avanti ... View more

Thanks for all your help but I am still getting the same output. I tried both ways:   "My Search"| table BAN, PAYLOAD | spath   "My Search"| spath | table BAN, PAYLOAD  Still the output is same. ... View more

Do you mean use spath in my search query after payload?   Can you please help me with the syntax?   Thanks for your help! ... View more

Here is the out put I am getting {"socClassifVvCode":"XX","logicalDate":"20210518","billingAccountId":"XXXXXXXXX","lastUpdateDate":"20210518181503","msisdn":null,"subStatus":null,"lastUpdateStamp":2245,"deepEventName":"XXXXXXXXXX","deepEventId":"2XXXXXXXX","action":"XXX","effectiveDate":"2021-05-18T17:00:00.000Z","channelId":"XX","productType":null,"requiredSoc":null} ] However I want in tabular format column wise for e.g.   ClassifCode|Date|AcctID XX|XX|XXXX   I may not be able to paste the actual query but sample encrypted one is as below: index=adms RestLoggingUtil XXXXXXXXXXX "/XXXXXXXXXXXXXX"| table BAN, PAYLOAD ... View more