Describe the bug
I recieve the error while performing search on splunk using Splunklib.
To Reproduce
Steps to reproduce the behavior:
Install Splunklib library
Peform search on SPlunk using Splunk API
Code is given below
Expected behavior
Search should be performed and desired results should be shown.
Splunk (please complete the following information):
Version: Splunk Enterprise. Version: 9.1.5 (on server)
OS: [e.g. MacOS 14.3]
SDK (please complete the following information):
Version: Java JDK version 8
Language Runtime Version: [e.g. Python 3.12]
OS: [e.g. MacOS 14.3 ]
code:
I am currently trying to connect with splunk server, make a search and get the results back using SplunkLib. I was able to make connection, and make small interactions like get all apps. However, when I perform search, I get an error and results stored are empty. Here is the code:
def connect_to_splunk(host=“Linktosplunk, port=8089):
splunk_username = os.environ.get('Splunk_Username')
plunk_password = os.environ.get('Splunk_Password')
if not splunk_username or not splunk_password:
raise ValueError("Splunk_Username and Splunk_Password environment variables must be set")
try:
service = connect(host=host, port=port, username=splunk_username, password=splunk_password,app=“MyApp", timeout=30)
return service
except Exception as e:
raise ConnectionError(f"Failed to connect to Splunk: {e}")
def splunk_query_search():
connection= connect_to_splunk()
search_query = "search tag::host=‘int’ method=PUT 1234 sourcetype=XZY earliest=-15m@m latest=@m"
try:
search_job = connection.jobs.oneshot(search_query)
sid = search_job.sid # Get the SID from the search job
results = search_job.read() # Retrieve search results
return [result for result in results] # Convert results to a list
except Exception as e:
print(f"Error during search: {e}")
return [] # Return empty list on error
however, I get this error on report:
INFO | Error during search: 'ResponseReader' object has no attribute 'sid'
${result} = []
How can I fix this? I am not using ResponseReader object anywhere in the code too..
Describe the bug I recieve the error while performing search on splunk using Splunklib.
To Reproduce Steps to reproduce the behavior:
Expected behavior Search should be performed and desired results should be shown.
Splunk (please complete the following information):
SDK (please complete the following information):
code:
I am currently trying to connect with splunk server, make a search and get the results back using SplunkLib. I was able to make connection, and make small interactions like get all apps. However, when I perform search, I get an error and results stored are empty. Here is the code:
however, I get this error on report:
INFO | Error during search: 'ResponseReader' object has no attribute 'sid' ${result} = []
How can I fix this? I am not using ResponseReader object anywhere in the code too..
Any lead would be helpful. Thank you..!