Splunk Dev

Fields defined by a sourcetype not being shown in query results by Splunk SDK?

yshen
Communicator

When I used the following code to perform a query:

service = client.connect(
host= 'splunk.bart.gov',
port = '8089',
username = 'userid',
password = 'secrete',
)

query = "search index=slog_ics sourcetype=occ_mgr  | table _time, ENTRY | head 3"
query_results = service.jobs.oneshot(query)
reader = res.ResultsReader(query_results)
results = []
for item in reader:
    print(item)
    results.append(item)
print("results[1]:")
print(results[1])

In the above result, I cannot see the value for the field ENTRY.

ENTRY is a field defined by the sourcetype occ_mgr in my application ics_analytics.

While in Splunk web UI, in the context of the application ics_analytics using the same query, I can see the field value of ENTRY:

index=slog_ics sourcetype=occ_mgr  | fields _time, ENTRY  | head 3

with the result:

	_time ENTRY
4/6/22 2:11:00.000 AM EOR.
4/6/22 1:48:00.000 AM (ref 0120) T203 released ATO, (762) second delay.
4/6/22 1:36:00.000 AM CORE Blanket established.

What could be the root cause of the problem?

 

 
 
 
 
Labels (2)
Tags (2)
0 Karma

yshen
Communicator

With hint by https://splunk-usergroups.slack.com/team/UB5DA9L02, it turns out that as the sourcetype is only known in the context of my application ics_analytics, in the service definition with SDK, I must indicate the application context with app= argument. Here is the corrected service definition:

 

service = client.connect(
host= 'splunk.bart.gov',
app='ics_analysis',
port = '8089',
username = 'userid',
password = 'secrete',
)

 

once the sourcetype is properly declared to be known, the same code as above would be able to retrieve the field value of ENTRY.

Here is the link to the relevant documentation:
https://docs.splunk.com/DocumentationStatic/PythonSDK/1.6.16/client.html#splunklib.client.Service

This is post is a capture of Slack discussion:
https://splunk-usergroups.slack.com/archives/C04DC8JJ6/p1649351828984919?thread_ts=1649265592.685629...

 

 

 
 
Tags (2)
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...