CODEWITHSUNDEEP
pythonpython-requestssplunk
user1471980
user1471980

Reputation: 10636

how do you get job id for splunk saved search in python

I am trying to retrieve job id from splunk using python.

when I do this in curl, it works. It prints out the sid number.

curl -u <username>:<password> -k https://example.com:8089/services/search/jobs -d search="search interface*"

I get:

<response>
  <sid>1899999967</sid>
</response>

I need to convert this curl code to python request, I tried this:

res=requests.get('https://example.com:8089/services/search/jobs', params= ('-d search='search interface*'"), auth=(<username>:<password>), verify=False)

I get a huge list of search results that incude other saved search results. I only need saved search interface*

Any ideas what I am doing here wrong?

Upvotes: 0

Views: 126

Answers (1)

Moti Vator
Moti Vator

Reputation: 49

Well this a 3 Part process.

First Part is run the query. (Which you did.)

Secound, check if the search ran. (Succesfully) curl -u 'admin' https://localhost:8089/services/search/jobs/1289517421.3076

Thrid retrieve the results, in xml or csv.

curl -u 'admin' https://localhost:8089/services/search/jobs/1289517421.3076/results -d"output_mode=csv"

Upvotes: 0

Related Questions