Splunk Dev

splunklib sourcetype

stevedhoward
Explorer

In the splunk UI, I can have a query such as the following...

host="cmhlpecomweb*" sourcetype=access_combined "GET /check-out/actions/gift-card-submit.jsp"

I have been unable to find how to do this through the splunklib python client.

I have tried numerous combinations, and can find no referecne to how to do this in the Splunk documention.

Examples of what has been tried

service.jobs.export("host=cmhlpecomweb* sourcetype=access_combined | search GET /check-out/actions/gift-card-submit.jsp",
**{"earliest_time":"2017-02-13T10:00:00.000-07:00"}))

service.jobs.export("regex field= host=cmhlpecomweb* sourcetype=access_combined | search GET /check-out/actions/gift-card-submit.jsp",
**{"earliest_time":"2017-02-13T10:00:00.000-07:00"}))

service.jobs.export("search GET /check-out/actions/gift-card-submit.jsp | host=cmhlpecomweb* sourcetype=access_combined ",
**{"earliest_time":"2017-02-13T10:00:00.000-07:00"}))

service.jobs.export("search GET /check-out/actions/gift-card-submit.jsp host=cmhlpecomweb* sourcetype=access_combined ",
**{"earliest_time":"2017-02-13T10:00:00.000-07:00"}))

Surely this can't be this difficult, but after spending the better part of an afternoon, I give up. Is this documented, or even possible? If documented, a pointer to that info would be great!

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Are you using the results reader?

http://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Search/ExportdatausingSDKs

import splunklib.client as client
import splunklib.results as results
service = client.connect(…)
rr = results.ResultsReader(service.jobs.export("search index=_internal earliest=-1h | head

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

Are you using the results reader?

http://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Search/ExportdatausingSDKs

import splunklib.client as client
import splunklib.results as results
service = client.connect(…)
rr = results.ResultsReader(service.jobs.export("search index=_internal earliest=-1h | head

0 Karma

stevedhoward
Explorer

Hi,

I am, but the syntax I had above consistently threw exceptions. I have since found that I can simply prefix the same search string with "search" (go figure :)), and escape the double quotations for host. After that, it works.

I will wait to verify I am not still missing anything, and then accept your answer.

Thanks,

Steve

0 Karma

jkat54
SplunkTrust
SplunkTrust

you can escape your quotes if you need them just add a \ before them ... \" should work... maybe \"

0 Karma

stevedhoward
Explorer

I think I found this, as the following works...

rr = results.ResultsReader(service.jobs.export("search host=\"cmhlpecomweb*\" sourcetype=access_combined GET /catalog/actions/giftcard-balance-submit.jsp", 
                                               **{"earliest_time":"2016-12-31T23:57:00.000-05:00",
                                                  "latest_time":"2017-01-01T00:00:00.000-05:00"}))

I think a more complete example should be in the docs for this, rather than search * | head 5.

Regardless, it works, so thanks to anyone that gave this some thought.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...