makeresults can be used to generate search results. An example from the documentation. | makeresults | eval test="buttercup rarity tenderhoof dash mcintosh fleetfoot mistmane" | makemv delim=" " test | mvexpand test _time test 2024-01-01 00:00:00 buttercup 2024-01-01 00:00:00 rarity 2024-01-01 00:00:00 tenderhoof 2024-01-01 00:00:00 dash 2024-01-01 00:00:00 mcintosh 2024-01-01 00:00:00 fleetfoot 2024-01-01 00:00:00 mistmane   Then you can use `search` or any other commands as usual. | makeresults | eval test="buttercup rarity tenderhoof dash mcintosh fleetfoot mistmane" | makemv delim=" " test | mvexpand test | search test="m*" _time test 2024-01-01 00:00:00 mcintosh 2024-01-01 00:00:00 mistmane ... View more

You can directly use the service object which is already authenticated.   service = self.service logger.debug(f"Splunk version: {service.info.version}")   Note that the namespace is app-specific and any item created will be owned by the user that runs the command. For example, I run the following search command as user1 in helloworld app.   service = self.service storage_passwords = service.storage_passwords storage_password = storage_passwords.create("password1", "bobuser") logger.debug(f"Successfully saved password for {storage_password.name} user")    This is equivalent to:   service = client.connect( token=self._metadata.searchinfo.session_key, owner="user1", app="helloworld", sharing="app" ) storage_passwords = service.storage_passwords ...    TL;DR if the operation is within an app, just use the "service" object; for cross-app operation, use "self._metadata.searchinfo.session_key" and specify "app" parameter. ... View more