Splunk Search

How to use search a CSV lookup file within an App via Python SDK?

BrentRiva
Explorer

I'm working in Python and trying to use the SDK to search from a program. One of the apps I have installed uses a lookup table (CSV file) to add fields to events, and I'm trying to search on those events (specifically, the CSV file in the app adds 'cost_center=____' to the data, and I'm trying to search for a specific call center).

As I don't know how to do this, my searches right now are returning 0 results. Is there a place I can read up on this, or is the answer easy enough to answer here?

Edit: Would namespace=<app_name> work?
Thanks!

0 Karma

BrentRiva
Explorer

Namespace= seems to be working, but I'm getting much less results than normal, though (1 million on the website vs. 260 on the API call). I think this is the answer, but I'll wait until a more definitive answer is posted.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...