无法获取Splunk查询SID

问题描述 投票:0回答:1

以下是我的代码片段:

search='index="someindex" earliest=27/01/2019:0:0:0 latest=27/01/2018:23:59:00'

data = {'search': search, 'max_count':'10000000'}
response = requests.post('https://something:8089/services/search/jobs',
                         auth=('usr', 'pwd'), data=data, verify=False)
#print(response)                         
root = ET.fromstring(response.text)
#print(root)
for tag in root:
    job_id = tag.text
    print(job_id)
print(job_id)

我得到400回应和打印job_id错误。

python splunk splunk-query splunk-sdk
1个回答
0
投票

如果您正在搜索索引,搜索字符串应以search关键字开头。

修改搜索字符串:

search='search index="someindex" earliest=27/01/2019:0:0:0 latest=27/01/2018:23:59:00'
© www.soinside.com 2019 - 2024. All rights reserved.