Splunk Dev

Splunk Python SDKm cannot get results from a query

dfofie
New Member

I'm using the latest Python SDK to send some requests to splunk, since i need to obtain those data from a script.
Somehow I'm unable to get the data, and the request is not failing, That says everything seems to be correctly working, but no results is returned.
I'm using exactly the same username/password combination as for the web login, sending the same request, From the web search, i get many thousands of results, but from the Python script, 0. This is the code snippet:

searchquery_normal = "search index=testing_cc_ps  sourcetype=doors_as"
kwargs_normalsearch = {"earliest_time": "@d",
                       "latest_time": "now",
                       "exec_mode": "blocking"}
job = splunk_service.jobs.create(searchquery_normal, **kwargs_normalsearch)

# A normal search returns the job's SID right away, so we need to poll for completion
while True:
    while not job.is_ready():
        print("Job is not ready")
        pass
    stats = {"isDone": job["isDone"],
             "doneProgress": float(job["doneProgress"]) * 100,
             "scanCount": int(job["scanCount"]),
             "eventCount": int(job["eventCount"]),
             "resultCount": int(job["resultCount"])}

    status = ("\r%(doneProgress)03.1f%%   %(scanCount)d scanned   "
              "%(eventCount)d matched   %(resultCount)d results") % stats

    sys.stdout.write(status)
    sys.stdout.flush()
    if stats["isDone"] == "1":
        sys.stdout.write("\n\nDone!\n\n")
        break
    sleep(2)

# Get the results and display them
for result in results.ResultsReader(job.results()):
    print(result)

job.cancel()
sys.stdout.write('\n')

That is the output

100.0% 0 scanned 0 matched 0 results
Done!

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

It looks like you are hitting same issue as explained in question https://answers.splunk.com/answers/691052/why-are-our-splunk-python-sdk-query-results-empty.html , try with sleep(5) after print("Job is not ready") line in while loop.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...