Following this example to list user and display properties from here: http://dev.splunk.com/view/python-sdk/SP-CAAAEJ6#listusers ends up in the following error: Users: Administrator (admin) Traceback (most recent call last): File "splunk.py", line 16, in <module> for role in user.role_entities: File "/usr/lib/python2.6/site-packages/splunklib/client.py", line 3054, in role_entities return [self.service.roles[name] for name in self.content.roles] File "/usr/lib/python2.6/site-packages/splunklib/client.py", line 3195, in __getitem__ return Collection.__getitem__(self, key.lower()) File "/usr/lib/python2.6/site-packages/splunklib/client.py", line 1163, in __getitem__ raise KeyError(key) KeyError: 'admin' shell returned 1 Copied and used the code snippet from above link, and logged in as admin using following service = splunkclient.connect(host='sh1.hostname', port=8089, username='admin', password='adminpassword') # Get the collection of users, sorted by realname kwargs = {"sort_key":"realname", "sort_dir":"desc"} users = service.users.list(count=-1,**kwargs) # Print the users' real names, usernames, and roles print "Users:" for user in users: print "%s (%s)" % (user.realname, user.name) for role in user.role_entities: print " - ", role.name Using splunk 6, python sdk 1.0.0. Can someone please help to overcome this issue? ... View more

Logging in using autologin=True in python splunk-sdk and executing a query gives ResponseReader object as expected if the session is not terminated, >>> import splunklib.client as splunkclient >>> splunk_service = splunkclient.connect(host='searchhead.com', port=8089, username='admin', password='password', autologin=True) >>> splunk_service.jobs.oneshot("search index=myindex", earliest_time='-1hour') <splunklib.binding.ResponseReader object at 0xaa2a10> To terminate the session restarted the splunk search head service in searchhead.com, it restarted splunkd, splunkweb, etc.. tried the following after splunk related services are started. Cross checked ports are connected and ready. But the query execution fails with some internal error? >>> splunk_service.jobs.oneshot("search index=myindex", earliest_time='-1hour') Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/lib/python2.6/site-packages/splunklib/client.py", line 2799, in oneshot **params).body File "/usr/lib/python2.6/site-packages/splunklib/client.py", line 743, in post **query) File "/usr/lib/python2.6/site-packages/splunklib/binding.py", line 248, in wrapper return request_fun() File "/usr/lib64/python2.6/contextlib.py", line 34, in __exit__ self.gen.throw(type, value, traceback) File "/usr/lib/python2.6/site-packages/splunklib/binding.py", line 180, in _handle_auth_error yield File "/usr/lib/python2.6/site-packages/splunklib/binding.py", line 248, in wrapper return request_fun() File "/usr/lib/python2.6/site-packages/splunklib/binding.py", line 61, in new_f val = f(*args, **kwargs) TypeError: post() takes at least 2 arguments (0 given) But trying again immediately succeeds, (able to reproduce, first try after restart of splunk service always fails and second succeeds): >>> splunk_service.jobs.oneshot("search index=myindex", earliest_time='-1hour') <splunklib.binding.ResponseReader object at 0xaa2e50> Is it a known issue? quick googling doesn't help much. Any help towards resolving this issue much appreciated. PS: Splunk 6, tried in both splunk-sdk 1.2.0 and 1.0.0 ... View more

Sample Data: Following is the result for a field which I'm tried to do chart for, Linux - 10% Unix - 10% Firefox - 40% Windows - 20% IE - 20% Instead of showing chart with above values, what should I do to view the following: Open source - 60% Commercial - 40% Open source is the grouping of the values (Linux, Unix, Firefox), and commercial is Windows and IE. So how to group multiple values of a single field into one for charting, and how to give it some name? Any help is much appreciated, thanks. ... View more