Splunk Dev

Script python with search SPL

wcastillocruz
Path Finder

Hello Splunk team,

do you know if it's possible to do a splunk search in a python script? taking into account the selection of the desired period (last week, last month ...).

for example for a simple search :

| append [search sourcetype=ESP_Histo env="Web" service="Application" apps="Web Sharepoints" fn="*" managed_entity="*- URL" sampler="SHAREPOINT - URL" ID_EVENT | eval Applications=case( apps like "%Web Sharepoints%","WEB SHAREPOINTS") | `transactions` ]

| eval max_time=if(info_max_time == "+Infinity", now(), info_max_time) | eval min_time=if(info_min_time == "0.000", 1577836800, info_min_time) | eval periode1=max_time-min_time
| stats sum(duration) AS durationindispo by Applications, periode1

| outputcsv append=true override_if_empty=false web_search

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, it's possible to perform a search in a Python script.  See https://docs.splunk.com/Documentation/Splunk/8.2.2/RESTREF/RESTsearch for the details.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Yes, it's possible to perform a search in a Python script.  See https://docs.splunk.com/Documentation/Splunk/8.2.2/RESTREF/RESTsearch for the details.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...