Splunk Search

Python SDK: Why do search results not contain keys for all fields?

CraigAtNuna
Explorer

I'm retrieving DNS lookup log results from Splunk using the Python SDK. One of the fields present in the log is the domain. The search returns an OrderedDict for each entry, but looking at the keys in the dict some fields (like domain) are not present. The search string is simple: search index=dnslog | tail 1.

    blocksearch_results = splunk_job.results(**kwargs_paginate)

    for result in results.ResultsReader(blocksearch_results):
        print result['domain']  # Doesn't work - no such key

In Splunk Web, 'domain' is one of the 'interesting fields'. I can see the domain value as part of result['_raw'], but digging it out of there is not the right way to go.

How do I get the dict to contain key/value pairs for all fields?

0 Karma
1 Solution

kbarker302
Communicator

You may need to use the fields option like this and explicitly name the fields you want:

search index=dnslog | fields domain field2 field3 | tail 1

I am not using the SDK, but I do have a Python script that executes a search using the REST API. If I don't specify fields, then I just get _raw in the response (I don't even get any interesting fields.) But I do get back as separate key/value pairs anything I ask for using fields.

View solution in original post

kbarker302
Communicator

You may need to use the fields option like this and explicitly name the fields you want:

search index=dnslog | fields domain field2 field3 | tail 1

I am not using the SDK, but I do have a Python script that executes a search using the REST API. If I don't specify fields, then I just get _raw in the response (I don't even get any interesting fields.) But I do get back as separate key/value pairs anything I ask for using fields.

arkadyz1
Builder

Did not work for me, alas. The reason might lie in the fact that all of the fields listed in my | fields pipe are aliased or calculated. Curiouser yet, I have this | fields <some field name>, <field name>, ... | fields -_rawfilter after my initial search, but the results don't have any of the fields while returning _raw just fine :(.

0 Karma

CraigAtNuna
Explorer

That works! You should post this as the answer!

kbarker302
Communicator

Thanks - actually, can you mark my comment as the answer? (There should be an option for that, maybe under the gear icon.)

0 Karma

ppablo
Retired

I converted for you 🙂 Cheers!

Patrick

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...