Splunk Dev

pulling Splunk Rest API in a python script

jmcclure8
New Member

I would like to pull the Splunk REST API jobs/$someSEARCH owner and use it as a variable in a python script
here is what I ahve so fare

def getAuthor(argvals, settings):
try:
namespace = settings.get("namespace", None)
sessionKey = settings['sessionKey']
ent = entity.getEntity('jobs', '| script python git', namespace=namespace, owner='nobody', sessionKey=sessionKey)
argvals ['author'] = ent['owner']
except Exception, e:
logger.error("Could not get the owner of the job. Error: %s" %(str(e)))
raise

logger.basicConfig(format='%(asctime)s %(levelname)s %(message)s', filename=os.path.join(os.environ['SPLUNK_HOME'],'var','log','splunk','git.log'), filemode='a+', level=logger.INFO)

keywords, argvals = splunk.Intersplunk.getKeywordsAndOptions()

em_message_fromArg = getarg(argvals, "message", "Commiting a with no message, please ask the owner about the change")

settings = splunk.Intersplunk.getOrganizedResults()

getAuthor(argvals, settings)

with open('/opt/splunk/etc/apps/incident_response/bin/test.txt', 'a') as file:
file.write(author)
What else could I do?

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...