python - 使用Python SDK导出数据

Question

我正在尝试使用Python SDK从Splunk导出数据。

for result in rr:
if isinstance(result, results.Message):
    # Diagnostic messages might be returned in the results
    print '%s: %s' % (result.type, result.message)
elif isinstance(result, dict):
    # Normal events are returned as dicts
    print result
assert rr.is_preview == False

输出数据如下:

OrderedDict([('TIME','1'),('UID','BUSINESS')])
OrderedDict([('TIME','12'),('UID','ACC')])
OrderedDict([('TIME','33'),('UID','TRAVEL')])

我不知道如何将数据传输到数据帧。我阅读了文档，它说 ResultsReader 是可迭代的并返回结果的字典。我尝试了 Pandas_DataFrame(rr) 并且它不起作用，表明数据参数不能是迭代器。

Answer 1

使用下面的语法。

import splunklib.client as client
import splunklib.results as results
import pandas as pd
from collections import OrderedDict

# Retrieve results using syntax below. Change SPL accordingly.
rr = results.ResultsReader(service.jobs.export("search index=<xxxxxxxxxxxx>")

df = pd.DataFrame(list(rr))
print(df)

  TIME       UID
0    1  BUSINESS
1   12       ACC
2   33    TRAVEL