Script python with search SPL

[wcastillocruz]

Hello Splunk team,

do you know if it's possible to do a splunk search in a python script? taking into account the selection of the desired period (last week, last month ...).

for example for a simple search :

| append [search sourcetype=ESP_Histo env="Web" service="Application" apps="Web Sharepoints" fn="*" managed_entity="*- URL" sampler="SHAREPOINT - URL" ID_EVENT | eval Applications=case( apps like "%Web Sharepoints%","WEB SHAREPOINTS") | `transactions` ]

| eval max_time=if(info_max_time == "+Infinity", now(), info_max_time) | eval min_time=if(info_min_time == "0.000", 1577836800, info_min_time) | eval periode1=max_time-min_time
| stats sum(duration) AS durationindispo by Applications, periode1

| outputcsv append=true override_if_empty=false web_search

[richgalloway · Accepted solution]

Yes, it's possible to perform a search in a Python script.  See https://docs.splunk.com/Documentation/Splunk/8.2.2/RESTREF/RESTsearch for the details.