使用 python 搜索 Splunk API

Question

我想要做的是使用 python 對 Splunk 的 API 執行搜索，我能夠獲得 session 密鑰，僅此而已。 我對 python 和 splunk 都是新手，所以我有點不深入，任何幫助都將不勝感激。

錯誤：

Traceback (most recent call last):
      File "splunkAPI.py", line 31, in <module>
        sid = minidom.parseString(r.text).getElementsByTagName('sid')[0].firstChild.nodeValue
    IndexError: list index out of range

python：

import time # need for sleep
from xml.dom import minidom

import json, pprint

import requests
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

base_url = 'https://___________:8089'
username = '______'
password = '______'
search_query = "____________"


#-------------------------get session token------------------------
r = requests.get(base_url+"/servicesNS/admin/search/auth/login",
        data={'username':username,'password':password}, verify=False)

session_key = minidom.parseString(r.text).getElementsByTagName('sessionKey')[0].firstChild.nodeValue
print ("Session Key:", session_key)

#-------------------- perform search -------------------------

r = requests.post(base_url + '/services/search/jobs/', data=search_query,
        headers = { 'Authorization': ('Splunk %s' %session_key)},
        verify = False)

sid = minidom.parseString(r.text).getElementsByTagName('sid')[0].firstChild.nodeValue

done = False
while not done:
        r = requests.get(base_url + '/services/search/jobs/' + sid,
                headers = { 'Authorization': ('Splunk %s' %session_key)},
                verify = False)
        response = minidom.parseString(r.text)
        for node in response.getElementsByTagName("s:key"):
                if node.hasAttribute("name") and node.getAttribute("name") == "dispatchState":
                        dispatchState = node.firstChild.nodeValue
                        print ("Search Status: ", dispatchState)
                        if dispatchState == "DONE":
                                done = True
                        else:
                                time.sleep(1)

r = requests.get(base_url + '/services/search/jobs/' + sid + '/results/',
        headers = { 'Authorization': ('Splunk %s' %session_key)},
        data={'output_mode': 'json'},
        verify = False)

pprint.pprint(json.loads(r.text))

Answer 1

嗯...該代碼看起來非常熟悉：P 不幸的是，當我編寫它時，錯誤檢查並不那么重要。

如果未正確定義 search_query，則會出現您看到的問題。 它必須以search=開頭。 另請注意，如果執行標准 Splunk 搜索，您需要包含初始search命令，

例如， search=search index=*將起作用， search=index=*將不起作用。

如果您需要在搜索字符串中包含引號，我建議您使用類似以下格式的內容。

search_query = """search=search index=* "a search expression" | stats count"""

Answer 2

試過了，但沒有給出需要的結果，不確定缺少什么

import urllib
import httplib2 #import library
import json
import pprint
import time
import re
from xml.dom import minidom

searchquery = 'search index="movable_in" sourcetype="movable:in:assets" | stats avg(exposure_score)'

myhttp = httplib2.Http()
baseurl = 'https://xxxx.splunkxxx.com:8089'
usernamesp = 'xxxx'
passwordsp = 'xxxx'


def get_splunk_result(searchquery):
    # Step 1: Get a session key
    servercontent = myhttp.request(f'{baseurl}/services/auth/login', 'POST', headers={},
                                   body=urllib.parse.urlencode({'username': usernamesp, 'password': passwordsp}))[1]
    sessionkey = minidom.parseString(servercontent).getElementsByTagName('sessionKey')[0].childNodes[0].nodeValue
    # print ("====>sessionkey:  %s  <====" % sessionkey)
    sid = ''
    # ------------------
    if not searchquery.startswith('search'):
        searchquery = f'search {searchquery}'

    # Step 2: Get a sid with the search query
    i = 0
    while True:
        time.sleep(1)
        try:
            searchjob = myhttp.request(f'{baseurl}/services/search/jobs', 'POST',
                                       headers={F'Authorization': F'Splunk %s' % sessionkey},
                                       body=urllib.parse.urlencode({'search': searchquery}))[1]
            sid = minidom.parseString(searchjob).getElementsByTagName('sid')[0].childNodes[0].nodeValue
            break
        except:
            i = i + 1
            # print(i)
            if (i > 30): break
    # print("====>SID:  %s  <====" % sid)
    # Step 3: Get search status

    myhttp.add_credentials(usernamesp, passwordsp)
    servicessearchstatusstr = '/services/search/jobs/%s/' % sid

    isnotdone = True
    while isnotdone:
        searchstatus = myhttp.request(f'{baseurl}{servicessearchstatusstr}', 'GET')[1]
        isdonestatus = re.compile('isDone">(0|1)')
        strstatus = str(searchstatus)
        isdonestatus = isdonestatus.search(strstatus).groups()[0]
        if (isdonestatus == '1'):
            isnotdone = False
# Step 4: Get the search result

    services_search_results_str = '/services/search/jobs/%s/results?output_mode=json_rows&count=0' % sid
    searchresults = myhttp.request(f'{baseurl}{services_search_results_str}', 'GET')[1]

    searchresults = json.loads(searchresults)
    # searchresults = splunk_result(searchresults)
    return searchresults


output = get_splunk_result(searchquery)
print(output)