如下:

curl -u admin:changeme -k https://localhost:8089/services/search/jobs -d search="search source=\"http:hec_test\" | head 5"
curl -u admin:changeme -k https://localhost:8089/services/search/jobs/1481684877.17/results/ --get -d output_mode=csv

更智能点:

sid=`curl -u admin:changeme -k https://localhost:8089/services/search/jobs -d search="search source=\"http:hec_test\" refresh" 2>/dev/null | sed "1,2d" | sed "2d" | sed "s/.*>\([0-9]*\.[0-9]*\)<.*/\1/"`
echo $sid
curl -u admin:changeme -k https://localhost:8089/services/search/jobs/$sid/results/ --get -d output_mode=json 2>/dev/null >out.json

python实现:

#!/usr/bin/python -u

import urllib
import httplib2
from xml.dom import minidom
import time
import json # The same python implementation for curl function
'''
sid=`curl -u admin:changeme -k https://localhost:8089/services/search/jobs -d search="search source=\"http:hec_test\" refresh | head 21" 2>/dev/null | sed "1,2d" | sed "2d" | sed "s/.*>\([0-9]*\.[0-9]*\)<.*/\1/"`
echo $sid
curl -u admin:changeme -k https://localhost:8089/services/search/jobs/$sid?output_mode=json
curl -u admin:changeme -k https://localhost:8089/services/search/jobs/$sid/results/ --get -d output_mode=json 2>/dev/null >out.json
''' class SplunkQuery(object):
def __init__(self):
self.baseurl = 'https://localhost:8089'
self.userName = 'admin'
self.password = 'changeme'
self.sessionKey = self.get_key() def get_key(self):
server_content = httplib2.Http(disable_ssl_certificate_validation=True).request(self.baseurl + '/services/auth/login', 'POST', headers={}, body=urllib.urlencode({'username':self.userName, 'password':self.password}))[1]
session_key = minidom.parseString(server_content).getElementsByTagName('sessionKey')[0].childNodes[0].nodeValue
return session_key def submit_job(self, search_query):
# check if the query has the search operator
if not search_query.startswith('search'):
search_query = 'search ' + search_query
sid_body = httplib2.Http(disable_ssl_certificate_validation=True).request(self.baseurl + '/services/search/jobs','POST', headers={'Authorization': 'Splunk %s' % self.sessionKey},body=urllib.urlencode({'search': search_query}))[1]
sid = minidom.parseString(sid_body).getElementsByTagName("sid")[0].childNodes[0].nodeValue
print "sid:", sid
return sid def request_results(self, sid):
start = time.time()
response = httplib2.Http(disable_ssl_certificate_validation=True).request(self.baseurl + '/services/search/jobs/' + sid + "?output_mode=json", 'POST', headers={'Authorization': 'Splunk %s' % self.sessionKey},body=urllib.urlencode({}))[1]
data = json.loads(response)
while not data["entry"][0]["content"]["isDone"]:
time.sleep(0.001)
response = httplib2.Http(disable_ssl_certificate_validation=True).request(self.baseurl + '/services/search/jobs/' + sid + "?output_mode=json", 'POST', headers={'Authorization': 'Splunk %s' % self.sessionKey},body=urllib.urlencode({}))[1]
data = json.loads(response)
request_time = time.time()-start
print "result event count:", data["entry"][0]["content"]["eventCount"], "request time:", request_time
result_response = httplib2.Http(disable_ssl_certificate_validation=True).request(self.baseurl + '/services/search/jobs/' + sid + "/results", 'GET', headers={'Authorization': 'Splunk %s' % self.sessionKey},body=urllib.urlencode({"output_mode": "json"}))[1]
results = json.loads(result_response)["results"]
assert data["entry"][0]["content"]["eventCount"] == len(results)
end = time.time()
print "result count:", len(results), "result request time:", end-start
return results def run(self, searchQuery):
start = time.time()
sid = self.submit_job(searchQuery)
self.request_results(sid)
end = time.time()
print "search time:", end-start
return start-end Q = SplunkQuery()
Q.run(searchQuery = 'sourcetype=hec_test | head 5')

参考:http://docs.splunk.com/Documentation/Splunk/6.5.1/RESTTUT/RESTsearches

splunk rest api search的更多相关文章

  1. 小记SharePoint REST API Search和COM

    1.管理员身份Visual Studio,新建类项目 SPCOM 2.编写逻辑实现代码 重点关注搜索结果的属性包括: Title,Author,Path,Description,HitHighligh ...

  2. ElasticSearch(十四) _search api search timeout 机制

    语法:timeout=10ms,timeout=1s,timeout=1m GET /_search?timeout=10m timeout:默认无timeout,latency平衡completen ...

  3. splunk中mongodb作用——存用户相关数据如会话、搜索结果等

    About the app key value store The app key value store (or KV store) provides a way to save and retri ...

  4. Splunk Enterprise architecture——转发器本质上是日志收集client附加负载均衡,indexer是分布式索引,外加一个集中式管理协调的中心节点

    Splunk Enterprise architecture and processes This topic discusses the internal architecture and proc ...

  5. 使用SPLUNK进行简单Threat Hunting

    通过订阅网上公开的恶意ip库(威胁情报),与SIEM平台中网络流量日志进行匹配,获得安全事件告警. 比如,这里有一个malware urls数据下载的网站,每天更新一次: https://urlhau ...

  6. .net 调用java rest ful api 实例

    注意post的参数组合 HttpWebRequest request = WebRequest.Create(url) as HttpWebRequest; request.Method = &quo ...

  7. 百度音乐API抓取

    百度音乐API抓取 前段时间做了一个本地音乐的播放器 github地址,想实现在线播放的功能,于是到处寻找API,很遗憾,不是歌曲不全就是质量不高.在网上发现这么一个APIMRASONG博客,有“获取 ...

  8. c# 请求api获得json数据

    public static string HttpGet(string Url) { HttpWebRequest request = (HttpWebRequest)WebRequest.Creat ...

  9. (07)odoo扩展API

    * 打开XML-RPC 连接    >>> import xmlrpclib    >>> srv, db = 'http://localhost:8069', ' ...

随机推荐

  1. android——学习:网格布局——GridLayout

    Android一开始就提供了几种布局控件,如线性布局LinearLayout.相对布局RelativeLayout和表格布局TableLayout等,但在很多情况下,这些布局控件是不能满足要求的,因此 ...

  2. Android内存泄露测试

    Android性能测试过程中的一些常用命令: CPU: adb shell top -n | grep "+PackageName 内存: adb shell dumpsys meminfo ...

  3. GATK3.2.2小结(转载)

    http://blog.csdn.net/skenoy/article/details/38346489 经过几天的摸索和网上资料的查询对GATK软件有点小心得,现总结如下: 1. fasta文件最好 ...

  4. LCD控制器与驱动器

    这回我再讲讲从 MCU 到 LCD 之间是怎样一个控制流程,即我们的位图数据是怎样显示到 LCD 上的.前面我们了解到 LCD 显示是用动态扫描的方式来实现的,每次显示一整行,在一帧里每行一次扫描一遍 ...

  5. windows 环境变量 %SystemDrive% 和 %SystemRoot%

    %SYSTEMROOT% == c:\windows (or the root windows directory) %SYSTEMDRIVE% == the drive windows is ins ...

  6. 【Todo】Python字符编码学习

    Python中经常出现字符编码问题,在这里统一整理吧. 参考这篇文章:http://www.cnblogs.com/huxi/archive/2010/12/05/1897271.html 另外这个人 ...

  7. Object Pascal 语法之异常处理

    http://www.cnblogs.com/spider518/archive/2010/12/30/1921298.html 3 结构化异常处理 结构化异常处理(SHE)是一种处理错误的手段,使得 ...

  8. Android 开源项目分类汇总(转)

    Android 开源项目分类汇总(转) ## 第一部分 个性化控件(View)主要介绍那些不错个性化的 View,包括 ListView.ActionBar.Menu.ViewPager.Galler ...

  9. POJ 3468(树状数组的威力)

    之前说过这是线段树的裸题,但是当看了http://kenby.iteye.com/blog/962159 这篇题解后我简直震惊了,竟然能如此巧妙地转化为用树状数组来处理,附上部分截图(最好还是进入原网 ...

  10. 【HTML5 】<script>元素async,defer异步加载

    原文地址:HTML5′s async Script Attribute原文日期: 2010年09月22日翻译日期: 2013年08月22日 (译者注: 异步加载,可以理解为无阻塞并发处理.) (译者再 ...