Splunk Dev

Python SDK - using the SDK to erase particular settings from stanzas

anirban_td
Explorer

I am using the Python SDK to add the allow_skew setting to savedsearches. 

See the generalised code snippet below: 

 

import splunklib.client as client

splunk_svc = client.connect(host="localhost", port=8089, username="admin", password="******")
savedsearch = splunk_svc.saved_searches["alert-splnk-test_email_v1"]

new_skew = "5m"
kwargs = {"allow_skew": new_skew}
savedsearch.update(**kwargs).refresh()

 


This code works and adds 'allow_skew = 5m' to the specific savedsearch stanzas in {app/local OR system/local} / savedsearches.conf / [alert-splnk-test_email_v1]
The code can also be extended to more/all savedsearches on the platform.
It also replicates the changes in a SH Cluster, as expected.

I want to have a reliable way to remove/erase the allow_skew setting from specific savedsearches, preferably using the Python SDK.
The setting needs to be removed from the stanza, so that the allow_skew setting from system / local / savedsearches.conf / [default] is picked up.

The only other ways I could think about are: 


Any help is appreciated. 

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...