Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- import splunk.auth
- import splunk.rest
- import splunk.search
- import json
- import time
- # Authenticate
- session_key = splunk.auth.getSessionKey(username='admin', password='changeme')
- search_to_run = "Errors in the last 24 hours"
- job = splunk.search.dispatchSavedSearch(search_to_run, session_key)
- print "Started job", job.id
- while not job.isDone:
- time.sleep(1)
- # Note: you will need to modify how you get output depending on if you want the events, results, or preview of the results
- # 1) Here is an example of getting results (when you use a reporting command in the search, like "stats")
- # dataset = job.results
- # 2) Here is an example of getting results_preview (when the search isn't done yet and you want to view the preview)
- # dataset = job.results_preview
- # 3) Here is an example of getting events (when you want the raw events and no reporting commands are used)
- dataset = job.events
- for event in dataset:
- print event['host']
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement