Developing for Splunk Platform

Fields defined by a sourcetype not being shown in query results by Splunk SDK?

yshen
Communicator

When I used the following code to perform a query:

service = client.connect(
host= 'splunk.bart.gov',
port = '8089',
username = 'userid',
password = 'secrete',
)

query = "search index=slog_ics sourcetype=occ_mgr  | table _time, ENTRY | head 3"
query_results = service.jobs.oneshot(query)
reader = res.ResultsReader(query_results)
results = []
for item in reader:
    print(item)
    results.append(item)
print("results[1]:")
print(results[1])

In the above result, I cannot see the value for the field ENTRY.

ENTRY is a field defined by the sourcetype occ_mgr in my application ics_analytics.

While in Splunk web UI, in the context of the application ics_analytics using the same query, I can see the field value of ENTRY:

index=slog_ics sourcetype=occ_mgr  | fields _time, ENTRY  | head 3

with the result:

	_time ENTRY
4/6/22 2:11:00.000 AM EOR.
4/6/22 1:48:00.000 AM (ref 0120) T203 released ATO, (762) second delay.
4/6/22 1:36:00.000 AM CORE Blanket established.

What could be the root cause of the problem?

 

 
 
 
 
Labels (2)
Tags (2)
0 Karma

yshen
Communicator

With hint by https://splunk-usergroups.slack.com/team/UB5DA9L02, it turns out that as the sourcetype is only known in the context of my application ics_analytics, in the service definition with SDK, I must indicate the application context with app= argument. Here is the corrected service definition:

 

service = client.connect(
host= 'splunk.bart.gov',
app='ics_analysis',
port = '8089',
username = 'userid',
password = 'secrete',
)

 

once the sourcetype is properly declared to be known, the same code as above would be able to retrieve the field value of ENTRY.

Here is the link to the relevant documentation:
https://docs.splunk.com/DocumentationStatic/PythonSDK/1.6.16/client.html#splunklib.client.Service

This is post is a capture of Slack discussion:
https://splunk-usergroups.slack.com/archives/C04DC8JJ6/p1649351828984919?thread_ts=1649265592.685629...

 

 

 
 
Tags (2)
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...