Skip to content

Instantly share code, notes, and snippets.

@npow
Created April 22, 2013 13:08
Show Gist options
  • Save npow/5434760 to your computer and use it in GitHub Desktop.
Save npow/5434760 to your computer and use it in GitHub Desktop.
Python Splunk REST API
#!/usr/bin/env python
import urllib, urllib2
import requests
import re
from xml.dom import minidom
base_url = 'https://amers1.splunk.cp.icp2.mpp.ime.reuters.com:8089'
username = 'user'
password = 'pass'
search_query = "search=savedsearch top_uuids"
# Login and get the session key
request = urllib2.Request(base_url + '/servicesNS/admin/search/auth/login',
data = urllib.urlencode({'username': username, 'password': password}))
server_content = urllib2.urlopen(request)
session_key = minidom.parseString(server_content.read()).\
getElementsByTagName('sessionKey')[0].childNodes[0].nodeValue
print "Session Key: %s" % session_key
# Perform a search
r = requests.post(base_url + '/services/search/jobs/', data=search_query,
headers = { 'Authorization': ('Splunk %s' %session_key)},
verify = False)
print r.text.split('\n')[1]
prog = re.compile(r'[^\d]+(\d+\.\d+)[^\d]+')
id = prog.match(r.text.split('\n')[1]).group(1)
print base_url + '/services/search/jobs/%s/results' % id
r = requests.get(base_url + '/services/search/jobs/%s/results' % id, data="output_mode=csv",
headers = { 'Authorization': ('Splunk %s' %session_key)},
verify = False)
print r.text
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment