@livehybrid Thanks for your reply I couldn't execute the splunk query in the splunk rest api using python script. Getting error message while executing the job. job has failed. | makeresults | eval msg="HelloWorld"  i can execute it on splunk UI. It takes "This search has completed and has returned 1 results by scanning 0 events in 0.302 seconds". I  ... View more

@PickleRick  @dataisbeautiful  Finally find the reason. unable to use the fields from splunk rest api. thats why we couldnt get the results. I will use the _raw data to find out the 500 http code and get the results. Thanks for your reply.  ... View more

@PickleRick Yes. I'm using the same user with both Web UI and Rest API access.  ... View more

@PickleRick Yes. I have web UI access also. When I search the query in Web splunk,  I get the results. the same query when i execute it in splunk rest api via python script, not getting any results. I dont know why.    ... View more

@dataisbeautiful Tried to use the below query also but no luck.  searchquery_blocking = '''search index=sample source="*sample*" AND host="v*lu*" OR host="s*mple*" | search httpcode="500" ''' still not getting any results. Its strange. I have been stuck on this for three days.  ... View more

@dataisbeautiful  do you have any solution for this issue? ... View more

yes. correct. if i remove | search httpcode = 500, i can get the results ... View more

import splunklib.client as client import splunklib.results as results   service = client.connect(         host="ipaddress",         port=portnumber,         username="username",         password="password",         scheme = "https"         )                kwargs_blockingsearch = {"exec_mode": "normal",                             "earliest_time": "-15m",                             "latest_time": "now",                             "enable_lookups": "true"}     searchquery_blocking = '''search index=sample source="*sample*" AND host="v*lu*" OR host="s*mple*" | search httpcode=500 '''     job = service.jobs.create(searchquery_blocking, **kwargs_blockingsearch)       while True:         while not job.is_ready():             pass         if job["isDone"] =="1":             break     results = job.results(**{"output_mode": "json"}) print(results) ... View more

The output 1 and 2 are the dynamic values which we get the values from the field "Field1".  I tried with your two queries but no luck. if i removed the condition(where) i can get the results. Seems like there is an issue with the condition (output1 and output2) ... View more

Thanks for your reply. I couldnt get any result on this query. if i removed the where condition i get the result i ran the query with last 4hrs like time                                     o/p1 o/p2 2024-11-09 01:02:00  1         1 2024-11-09 02:02:00   1         1     ... View more