Getting Data In

search/jobs/export not returning valid JSON

opticsplanet
Path Finder

After upgrade to Splunk 5, search/jobs/export stopped returning valid JSON on request. Upon inspection, I see that it returns preview results in addition to the final one.

How do I make it return only finalized result?

I tried adding "exec_mode=oneshot" in the post data, but this has no effect. I tried adding the same thing in the search string, but instead of getting only final result, the search is finalized before I get full results.

Here are some examples of correct results, but invalid json (this happens with or without exe_mode set in post data):

{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"7.451046943"}}
{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"72.3570270548"}}
{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"462.3673467760"}}
{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"730.9158630706"}}
{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"942.3713274259"}}
{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"1089.2731590699"}}
{"preview":false,"offset":0,"lastrow":true,"result":{"sum(MB)":"1089.2731590699"}}

Here is the result when I run the same query with exec_mode=oneoff in the search string itself:

{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"7.343144416"}}
{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"71.4846410748"}}
{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"209.8987865451"}}
{"preview":false,"offset":0,"lastrow":true,"result":{"sum(MB)":"209.8987865451"}}

Splitting the result by new line, and then grabbing only the last one is not an option, as most of the searches that I have to do through the API run for an hour or so, and produce massive resultset.

Let me know if additional information is needed.

Tags (3)

yannK
Splunk Employee
Splunk Employee

opticsplanet
Path Finder

According to this: http://dev.splunk.com/view/splunk-python-sdk-how-to/SP-CAAAEE5, exec_mode=oneshot should make it a valid JSON, but it does not work.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...