I'm doing a main search of a sourcetype, then I need to join with a csv file using the inputlookup, both the main search and the subsearch have the `Name` column, but when sending the complete search through the api, it does not return the values correctly, but when I do the search manually in splunk it works correctly.
import splunklib.client as client
service = client.connect(host=host, port=port, username=user, password=password)
search = '''search''' + '''index="aiops_main" sourcetype="scom_np" OR sourcetype="scom_p" type="*SQL*" AND (type="*AlwaysOn*" OR type="*Server Service Stopped*")
| join type=left Name
[| inputlookup maintenance_window.csv max=0
| eval Name=lower(Name)
| table Name, maint_down_start_time, maint_down_end_time, change_ticket]
| eval is_maintenance = if((alwayson_failovertime >= maint_down_start_time) AND alwayson_failovertime < maint_down_end_time,"true","false")
| table Name, type, is_maintenance
'''
kwargs_export = {
"earliest_time": '1',
"latest_time": "now",
"search_mode": "normal",
"exec_mode": "blocking",
}
# Create job and return results
try:
job = service.jobs.create(search, parse_only=False, **kwargs_export)
print(time.strftime('\n%Y_%m_%d__%H:%M:%S'))
print("...done!")
except Exception as e:
print("Trouble connecting to Splunk. Try again in a few seconds")
raise e
This error appears: "INFO: [subsearch]: Your timerange was substituted based on your search string"
In short: the is_maintenance field when run manually in Splunk returns some lines as True, while running the same search in python returns all as False.
... View more
