def main():
    usage = "usage: follow.py <search>"
    opts = utils.parse(sys.argv[1:], {}, ".splunkrc", usage=usage)

    if len(opts.args) != 1:
        utils.error("Search expression required", 2)
    search = opts.args[0]

    service = client.connect(**opts.kwargs)

    job = service.jobs.create(
        search, 
        earliest_time="rt", 
        latest_time="rt", 
        search_mode="realtime")

    # Wait for the job to transition out of QUEUED and PARSING so that
    # we can if its a transforming search, or not.
    while True:
        job.refresh()
        if job['dispatchState'] not in ['QUEUED', 'PARSING']:
            break
        time.sleep(2) # Wait
        
    if job['reportSearch'] is not None: # Is it a transforming search?
        count = lambda: int(job['numPreviews'])
        items = lambda _: job.preview()
    else:
        count = lambda: int(job['eventCount'])
        items = lambda offset: job.events(offset=offset)
    
    try:
        follow(job, count, items)
    except __HOLE__:
        print "\nInterrupted."
    finally:
        job.cancel()
dataset/ETHPy150Open splunk/splunk-sdk-python/examples/follow.py/main