Splunk Operational Intelligence Cookbook - Third Edition

Paginating the results of your search

Leveraging the program created in this recipe, you can modify it as follows to paginate through your results:

 
job = service.jobs.create(searchquery, **kwargs) 
print "Job completed...printing results!n" 
 
total  = job["resultCount"] 
offset = 0; 
count  = 10; 
 
while (offset < int(total)): 
    page_args = {"count": count, 
                 "offset": offset} 
 
    search_results = job.results(**page_args) 
    reader = results.ResultsReader(search_results) 
    for result in reader: 
        print "Result: %s => %s" % (result['clientip'],result['count']) 
    offset += count 

Paging your results from the server is a more efficient approach to retrieving the results for searches with many results as the Splunk server doesn't have to try and put all of the data into ...