ryancurrah/searchsplunk

Easily create Splunk searches from Python and get the result as a Python object.

Search Splunk

Easily create Splunk searches from Python and get the result as a Python object

Requires

• requests>=2.7.0: https://pypi.python.org/pypi/requests

Installation instructions

Searchsplunk can be installed from PyPi.

pip install searchsplunk

Usage instructions

from searchsplunk.searchsplunk import SearchSplunk
s = SearchSplunk('https://splunk.acme.com:8089', 'MYUSER', 'MYPASS', ssl_verify=True)
result = s.search('sourcetype=salt:grains openstack_uid=e0303456c-d5a3-789f-ab68-8f27561ffa0f | dedup openstack_uid')

import json
print json.dumps(result, sort_keys=True, indent=2)
{
  "fields": [
    {
      "name": "_bkt"
    },
    {
      "name": "_cd"
    },
    {
      "name": "_indextime"
    },
    {
      "name": "_kv"
    },
    {
      "name": "_raw"
    },
    {
      "name": "_serial"
    },
    {
      "name": "_si"
    },
    {
      "name": "_sourcetype"
    },
    {
      "name": "_subsecond"
    },
    {
      "name": "_time"
    },
    {
      "name": "host"
    },
    {
      "name": "index"
    },
    {
      "name": "linecount"
    },
    {
      "name": "openstack_uid"
    },
    {
      "name": "source"
    },
    {
      "name": "sourcetype"
    },
    {
      "name": "splunk_server"
    }
  ],
  "init_offset": 0,
  "messages": [],
  "preview": false,
  "results": [
    {
      "_bkt": "main~1122~25B521A6-9612-407D-A1BA-F8KJSEBB7628",
      "_cd": "1122:290410720",
      "_indextime": "1435071966",
      "_kv": "1",
      "_raw": "somefile contents",
      "_serial": "0",
      "_si": [
        "splunkserv",
        "main"
      ],
      "_sourcetype": "salt:grains",
      "_time": "2015-06-23T11:06:05.000-04:00",
      "host": "server-7654.acme.com",
      "index": "main",
      "linecount": "17",
      "openstack_uid": "e0303456c-d5a3-789f-ab68-8f27561ffa0f",
      "source": "/etc/salt/grains",
      "sourcetype": "salt:grains",
      "splunk_server": "splunkmaster"
    }
  ]
}

Contributors

• pkeeper
• lowell80

Author

Ryan Currah

License

GPL v2

searchsplunk's Issues

can you help me how to specify time search?

def connectSplunk(host=_splunkhost, user=_splunkuser, passwd=_splunkpass, ssl_verify = _splunk_sslverify):
    try:
        splunkObj = SearchSplunk(host, user, passwd, ssl_verify=ssl_verify)
        return splunkObj
    except Exception as e:
        error(e.Message)
        return None
    

def searchSplunk(query, host=_splunkhost, user=_splunkuser, passwd=_splunkpass, ssl_verify = _splunk_sslverify):
    s = connectSplunk(host, user, passwd, ssl_verify)
    res = s.search(query)
    
    return res

query = '''
search index=xxxx
| table a,b,c
'''

query = query + '&earliest_time=%s&latest_time=%s'
search = 'blahblah'
start_time = '2018-03-17T00:00:00'
end_time = '2018-03-18T00:00:00'
query = query%(search,start_time,end_time)
print "Executing Query : \n"+query
res = searchSplunk(query)

the above code returns error
can you help me how to specify time specification?

u'messages': [{u'text': u"Error in 'table' command: Invalid argument: '&earliest_time=2018-03-17T00:00:00&latest_time=2018-03-18T00:00:00'", u'type': u'FATAL'}]}