Getting Data In

Why am I unable to filter a saved search using the Splunk Python SDK?

photuris
Explorer

In the main Splunk interface, I can filter down on a saved search like this:

| savedsearch "my_search" | search title="Elite Baller" person="me" | table *

This will run my saved search, "my_search", and then filter down the results further.

I'm trying to do the same thing in the SDK (Python), using the same saved search. But it's not working for me! I've tried many iterations:

...
# Load Saved Search
saved_search = self.connect().saved_searches['my_search']

# Load Job
if saved_search.history():
    job = saved_search.history()[-1]
else:
    job = saved_search.dispatch()

# Poll API
while True:
    job.refresh()

    if job['isDone'] == '1':
        break

# Here's where I'm trying to filter down the search further
search = ''

# search_items['title'] = 'Elite Baller'
# search_items['person'] = 'me'
if len(search_items) > 0:
    search += 'search '

    for key, val in iteritems(search_items):
        search += '%s%%3D%s ' % (key, val)

    search = search[:-1]    # trim trailing space

job_kwargs['search'] = search

# Fetch Result
job_result = job.results(**job_kwargs)
reader = results.ResultsReader(job_result)

# ... iterate over reader ... #

Anyway, I've tried every which way to build an argument list string and place it into job_kwargs, but no such luck.

Am I missing something simple?

Thanks!

0 Karma

marco_sulla
Path Finder

For what I know, you can't postprocess a job in Python SDK. But you can perform the search itself:

import splunklib.client as client

sp_con = client.connect(username='admin', password='password', host='127.0.0.1', 
                        scheme='https', port='8089', app='appname', 
                        autologin=True)

query = """
| savedsearch "my_search" | 
search title="Elite Baller" person="me" | 
table *
"""

earliest = an_epoch_time
latest = an_epoch_time

rr = sp_con.jobs.oneshot(query, count=0, earliest_time=earliest, 
                         latest_time=latest)

Remember to give correct app and username to your connection, or your saved search will be not visible to the script.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...