Building for the Splunk Platform

Fields defined by a sourcetype not being shown in query results by Splunk SDK?

yshen
Communicator

When I used the following code to perform a query:

service = client.connect(
host= 'splunk.bart.gov',
port = '8089',
username = 'userid',
password = 'secrete',
)

query = "search index=slog_ics sourcetype=occ_mgr  | table _time, ENTRY | head 3"
query_results = service.jobs.oneshot(query)
reader = res.ResultsReader(query_results)
results = []
for item in reader:
    print(item)
    results.append(item)
print("results[1]:")
print(results[1])

In the above result, I cannot see the value for the field ENTRY.

ENTRY is a field defined by the sourcetype occ_mgr in my application ics_analytics.

While in Splunk web UI, in the context of the application ics_analytics using the same query, I can see the field value of ENTRY:

index=slog_ics sourcetype=occ_mgr  | fields _time, ENTRY  | head 3

with the result:

	_time ENTRY
4/6/22 2:11:00.000 AM EOR.
4/6/22 1:48:00.000 AM (ref 0120) T203 released ATO, (762) second delay.
4/6/22 1:36:00.000 AM CORE Blanket established.

What could be the root cause of the problem?

 

 
 
 
 
Labels (2)
Tags (2)
0 Karma

yshen
Communicator

With hint by https://splunk-usergroups.slack.com/team/UB5DA9L02, it turns out that as the sourcetype is only known in the context of my application ics_analytics, in the service definition with SDK, I must indicate the application context with app= argument. Here is the corrected service definition:

 

service = client.connect(
host= 'splunk.bart.gov',
app='ics_analysis',
port = '8089',
username = 'userid',
password = 'secrete',
)

 

once the sourcetype is properly declared to be known, the same code as above would be able to retrieve the field value of ENTRY.

Here is the link to the relevant documentation:
https://docs.splunk.com/DocumentationStatic/PythonSDK/1.6.16/client.html#splunklib.client.Service

This is post is a capture of Slack discussion:
https://splunk-usergroups.slack.com/archives/C04DC8JJ6/p1649351828984919?thread_ts=1649265592.685629...

 

 

 
 
Tags (2)
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...