Hello,  Can splunk python sdk be used along with a summary index? How? I wish to schedule periodic querying and extracting the data from Splunk for which I usually used the SDK like this and it works for 1 time run as I removed my "collect index ..." code from my query - service = client.connect( host=HOST,  port=PORT,  username=USERNAME,  password=PASSWORD) kwargs_oneshot = {"earliest_time": "-1h",   "latest_time": "now",   "output_mode": 'json', "count" : 100} searchquery_oneshot = "search <query>"  # if i want collected index results to be used below periodically i.e. every 1 hour, what change do I make in my code? oneshotsearch_results = service.jobs.oneshot(searchquery_oneshot, **kwargs_oneshot) Thanks ... View more

Hello, oneshotsearch_results = service.jobs.oneshot(searchquery_oneshot, **kwargs_oneshot) reader = results.JSONResultsReader(oneshotsearch_results) for item in reader:   if(isinstance(item, dict)):     for key in item:       if(key == '<...>'):         A = str(item[key])         print('A is :',A) The above code was working till yesterday. Now it does not enter the 1st for loop (i.e. for item in reader) anymore. I verified this by adding a print statement before the 1st if statement and it is not printing. ... View more

hello, as per https://docs.splunk.com/Documentation/Splunk/9.3.0/Forwarding/EnableforwardingonaSplunkEnterpriseinstance where are the files like outputs, props and transforms stored? i am using splunk web enterprise. Also where is my $splunk_home? am trying to setup heavy forwarding to send indexed data to a database on a schedule. thanks ... View more

Hello, I have a query - searchquery_oneshot = "search (index=__* ... events{}.name=ResourceCreated) | dedup \"events{}.tags.A\" | spath \"events{}.tags.A\" || lookup Map.csv \"B\" OUTPUT \"D\" | table ... | collect ... I ran this using Python SDK in VSCode as - oneshotsearch_results = service.jobs.oneshot(searchquery_oneshot, **kwargs_oneshot) conn.cursor().execute(sql, val) I ran the above using psycopg2 and got this error- FATAL: Error in 'lookup' command: Could not construct lookup 'Map.csv, B, OUTPUT, D'. See search.log for more details. The above query works when run inside splunk enterprise i.e. map.csv is looked-up and result fetched correctly. How do I locate my search.log? It is  splunkhome/var/lib/dispatch/run I assume. What is the error above? Thanks ... View more

Hello, I have a query used on Splunk enterprise web (search)- "index="__eit_ecio*" | ... | bin _time span=12h | ... | table ... | I am trying to put that into a python API code using Job class as this - searchquery_oneshot ="<my above query>" I am getting error - "SyntaxError: invalid decimal literal" pointing to the 12h  in main query. How can I fix this? [2) Can I direct "collect" results (summary index) via this API into json format?] Thanks ... View more

Hello, I ran the following code - from __future__ import print_function import urllib.request, urllib.parse, urllib.error import httplib2 from xml.dom import minidom baseurl = '<url>' userName = '<username>' password = '<password>' searchQuery = <query> # Authenticate with server. # Disable SSL cert validation. Splunk certs are self-signed. serverContent = httplib2.Http(disable_ssl_certificate_validation=True).request(baseurl + '/services/auth/login', 'POST', headers={}, body=urllib.parse.urlencode({'username':userName, 'password':password}))[1] sessionKey = minidom.parseString(serverContent).getElementsByTagName('sessionKey')[0].childNodes[0].nodeValue # Remove leading and trailing whitespace from the search searchQuery = searchQuery.strip() # If the query doesn't already start with the 'search' operator or another # generating command (e.g. "| inputcsv"), then prepend "search " to it. if not (searchQuery.startswith('search') or searchQuery.startswith("|")): searchQuery = 'search ' + searchQuery print(searchQuery) # Run the search. # Again, disable SSL cert validation. print(httplib2.Http(disable_ssl_certificate_validation=True).request(baseurl + '/services/search/jobs','POST', headers={'Authorization': 'Splunk %s' % sessionKey},body=urllib.parse.urlencode({'search': searchQuery}))[1]) I get this error - "TimeoutError: [WinError 10060] A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond" Is my url format wrong? Thanks ... View more

Hello. I have Splunk Enterprise (https://splunk6.****.net run from a browser) and am running a query collecting results and saving as a report (to get the output periodically i.e. summary indexing). How do I connect to my Postgres database installed on my PC to send/store this data? DB connect is not supported for my system (deprecated / sunset) Thanks ... View more