Splunk Dev

Why using earliest_time and latest_time in oneshot search through REST API doesn't return all expected results?

fere
Path Finder

I am running a search from a python script, following the example for onetime searches.
I have

searchquery_oneshot = ' search source=xxxx | table _time event screen '
kwargs_oneshot = {'latest_time': '-1h@h', 'output_mode': 'csv', 'earliest_time': '2014-01-01T00:00:00.000'}

It should have returned hundreds of records (when I run the same search and choose the same earliest and latest) ; However, it returned only 82 records for a recent 30 min or so timespan. It didn't even include ALL the records for that 30 mins.

Any suggestions please? I always need to have a fixed earliest time (its value gets calculated every night we run the script)

1 Solution

fere
Path Finder

The problem was actually that Splunk has a limit on number of records it returns in the result set. I am using oneshot search and there doesn't seem to be a param for setting it to a high number.

View solution in original post

rbarajas
Explorer

Try setting this in the jobargs before you submit your job:

oneshotSearchArgs.add("count", 0);
0 Karma

fere
Path Finder

The problem was actually that Splunk has a limit on number of records it returns in the result set. I am using oneshot search and there doesn't seem to be a param for setting it to a high number.

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...