2

I am trying to pass query from Python(eclipse IDE) to extract data from specific dashboard on SPLUNK enterprises. I am able to get data printed on my console by passing the required queries however I am not able to extract data for specific time interval(like if I want data for 1 hour, 1 day, 1 week or 1 month)

I have tried commands like 'earliest', 'latest' along with my query but every time it throws an error stating "raise HTTPError(response) splunklib.binding.HTTPError: HTTP 400 Bad Request -- Search Factory: Unknown search command 'earliest'"

Here is my code

import splunklib.client as client
import splunklib.results as results


HOST = "my hostname"
PORT = 8089
USERNAME = "my username"
PASSWORD = "my password"
service = client.connect(
host=HOST,
port=PORT, 
username=USERNAME,
password=PASSWORD)
rr = results.ResultsReader(service.jobs.export("search index=ccmjimmie | stats count(eval(resCode!=00200)) AS errored | chart sum(errored)|earliest=-1d"))

for result in rr:
    if isinstance(result, results.Message):
    # Diagnostic messages might be returned in the results
        print(result.type, result.message)
    elif isinstance(result, dict):
    # Normal events are returned as dicts
        print (result)
assert rr.is_preview == False

Output I am getting without using time query

OrderedDict([('sum(errored)', '1566')])
OrderedDict([('sum(errored)', '4404')])
OrderedDict([('sum(errored)', '6655')])
OrderedDict([('sum(errored)', '8992')])
etc...

This output is same as expected but not bounded by time. I want the same output but for Given Time Interval. And time interval should be passed from the search query "serch.jobs.export()" in the above Python code

Please let me know how do I pass 'time' query along with my required query.

Any help is most appreciated! Thanks in advance!

NagarjunKS
  • 21
  • 4

2 Answers2

1

You have to put the earliest at the beginning of your search. Example for - 1 day until now:

"search index=ccmjimmie earliest=-1d | stats count(eval(resCode!=00200)) AS errored | chart sum(errored)"

Details see here: https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/SearchTimeModifiers

and
  • 127
  • 11
0

I may have used a different process to run Splunk queries by Python and get search results in JSON. However passing 'time' is very convenient in this way.

Here I am doing so by passing the earliest and latest time variables in the request body of the post request.

post_data = { 'id' : unique_id,
              'search' : search_query,
              'earliest_time' : '1',
              'latest_time' : 'now',
            }

You can find the complete details here: https://stackoverflow.com/a/66747167/9297984

Mayank
  • 79
  • 6