Splunk Search

How can I not to iterate ResultsReader if I want to return results to Splunk. Python SDK.

astarchenkov
Explorer

This is a part of custom search command (EventingCommand) fro example. I get some input events and start jobs based on them.

def transform(self, events):

        event = events.next()
        search = getSearchFromEvent(event)
        job = self.service.jobs.create(search)

        while not job.is_done():
        reader = results.ResultsReader(job.results(count = 0))
        for line in reader:
                yield line

Is it possible to skip iteration and return results as generator or something like without this circle?

0 Karma

p_gurav
Champion

This may help. Refer "To display results without a reader" in below doc:
http://dev.splunk.com/view/python-sdk/SP-CAAAER5

0 Karma

astarchenkov
Explorer

Thanks for attention! I meant I don't want make transfer of result data through my search command at all.

P.S. I'll try if this gives performance benefits and add info here.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...