How is field1 defined? Is it a custom extraction you put in place? Is it shared globally?
Is the account you're using to log in to SplunkWeb the same account you're using for the python script?
I put your code into a python script and it seems to work just fine (I removed the timeframe from the search string for mine):
search_text = "search source=source1 field1=*"
job = service.jobs.create(search_text)
while True:
while not job.is_ready():
pass
stats = {"isDone": job["isDone"],
"doneProgress": float(job["doneProgress"])*100,
"scanCount": int(job["scanCount"]),
"eventCount": int(job["eventCount"]),
"resultCount": int(job["resultCount"])}
status = ("\r%(doneProgress)03.1f%% %(scanCount)d scanned "
"%(eventCount)d matched %(resultCount)d results") % stats
sys.stdout.write(status)
sys.stdout.flush()
if stats["isDone"] == "1":
sys.stdout.write("\n\nDone!\n\n")
break
sleep(2)
... View more
