Closed
Description
I am trying to export splunk result into json format using splunk sdk.
Below is the code I am using, this works when output_mode is csv, but when I use json, it fails with the error mentioned below.
job = service.jobs.create(searchquery, **{"exec_mode": "blocking",
"earliest_time": default_timeline,
"latest_time": "now",
"output_mode": "json",
"maxEvents": 10000000})
offset = 0;
count = 10000;
thru_counter = 0
resultCount = int(job["resultCount"])
if rescount == 0:
print "No Results Found for the above searchquery"
return False
while (offset < rescount):
kwargs_paginate = {"count": count, "offset": offset, "output_mode": "json"}
rs = job.results(**kwargs_paginate)
output = rs.read()
print rs.read()
Below error:
"maxEvents": 10000000})
File "/Library/Python/2.7/site-packages/splunklib/client.py", line 2944, in create
sid = _load_sid(response)
File "/Library/Python/2.7/site-packages/splunklib/client.py", line 228, in _load_sid
return _load_atom(response).response.sid
File "/Library/Python/2.7/site-packages/splunklib/client.py", line 203, in _load_atom
.decode('utf-8', 'xmlcharrefreplace'), match)
File "/Library/Python/2.7/site-packages/splunklib/data.py", line 85, in load
root = XML(text)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/xml/etree/ElementTree.py", line 1311, in XML
parser.feed(text)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/xml/etree/ElementTree.py", line 1659, in feed
self._raiseerror(v)
File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/xml/etree/ElementTree.py", line 1523, in _raiseerror
raise err
ParseError: not well-formed (invalid token): line 1, column 0
I updated the sdk version to 1.6.11, still the same.