After upgrade to Splunk 5, search/jobs/export stopped returning valid JSON on request. Upon inspection, I see that it returns preview results in addition to the final one.
How do I make it return only finalized result?
I tried adding "exec_mode=oneshot" in the post data, but this has no effect. I tried adding the same thing in the search string, but instead of getting only final result, the search is finalized before I get full results.
Here are some examples of correct results, but invalid json (this happens with or without exe_mode set in post data):
{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"7.451046943"}}
{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"72.3570270548"}}
{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"462.3673467760"}}
{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"730.9158630706"}}
{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"942.3713274259"}}
{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"1089.2731590699"}}
{"preview":false,"offset":0,"lastrow":true,"result":{"sum(MB)":"1089.2731590699"}}
Here is the result when I run the same query with exec_mode=oneoff in the search string itself:
{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"7.343144416"}}
{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"71.4846410748"}}
{"preview":true,"offset":0,"lastrow":true,"result":{"sum(MB)":"209.8987865451"}}
{"preview":false,"offset":0,"lastrow":true,"result":{"sum(MB)":"209.8987865451"}}
Splitting the result by new line, and then grabbing only the last one is not an option, as most of the searches that I have to do through the API run for an hour or so, and produce massive resultset.
Let me know if additional information is needed.
please read this answer on the same subject.
http://splunk-base.splunk.com/answers/65932/rest-api-json-invalid-format
According to this: http://dev.splunk.com/view/splunk-python-sdk-how-to/SP-CAAAEE5, exec_mode=oneshot should make it a valid JSON, but it does not work.