splunk / splunk-sdk-python

Splunk Software Development Kit for Python
http://dev.splunk.com
Apache License 2.0
698 stars 370 forks source link

ResponseReader object has no attribute 'sid' #581

Open GitAmi55 opened 2 months ago

GitAmi55 commented 2 months ago

Describe the bug I recieve the error while performing search on splunk using Splunklib.

To Reproduce Steps to reproduce the behavior:

  1. Install Splunklib library
  2. Peform search on SPlunk using Splunk API
  3. Code is given below

Expected behavior Search should be performed and desired results should be shown.

Splunk (please complete the following information):

SDK (please complete the following information):

code:

I am currently trying to connect with splunk server, make a search and get the results back using SplunkLib. I was able to make connection, and make small interactions like get all apps. However, when I perform search, I get an error and results stored are empty. Here is the code:

def connect_to_splunk(host=“Linktosplunk, port=8089):
    splunk_username = os.environ.get('Splunk_Username')
    plunk_password = os.environ.get('Splunk_Password')

    if not splunk_username or not splunk_password:
        raise ValueError("Splunk_Username and Splunk_Password environment variables must be set")

    try:
        service = connect(host=host, port=port, username=splunk_username, password=splunk_password,app=“MyApp", timeout=30)
        return service

    except Exception as e:
        raise ConnectionError(f"Failed to connect to Splunk: {e}")
def splunk_query_search():
    connection= connect_to_splunk()
    search_query = "search tag::host=‘int’ method=PUT 1234 sourcetype=XZY earliest=-15m@m latest=@m"

    try:
        search_job = connection.jobs.oneshot(search_query)
        sid = search_job.sid  # Get the SID from the search job

        results = search_job.read() # Retrieve search results
        return [result for result in results]  # Convert results to a list

    except Exception as e:
        print(f"Error during search: {e}")
        return []  # Return empty list on error

however, I get this error on report:

INFO | Error during search: 'ResponseReader' object has no attribute 'sid' ${result} = []

How can I fix this? I am not using ResponseReader object anywhere in the code too..

Any lead would be helpful. Thank you..!