Splunk Dev

Splunk Python SDK: Mismatch Results

kavithaisplunk
New Member

I am using Splunk Python SDK to run series of splunk queries. Recently encountered an issue, results from SDK and manually running query on the Web yields different results. All I am trying to do is run a simple query to get the count for a particular timeframe(index=xxx | stats count). I see SDK query result count is short of 1 million than the one executed manually. I did verify the timeframe is same in both the case. Could someone shed some light?

Labels (2)
0 Karma

raduurjan
Explorer

Try adding the following arguments in the kwargs dictionary:

"count" : 0

This will not limit your results if a limit exists somewhere.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Please post both the manual search and the code used with the sdk to create the search via API.

Please be sure the user executing the search is the same.

Please verify the job properties match between both jobs. (Open splunk UI -> Activity -> Jobs -> find your job -> click job drop down -> inspect job)

0 Karma

kavithaisplunk
New Member

I am exactly doing the same as below.. Running the same query manually I get 5 Million as Total count but running through the below code returns only 4 Million as Total count.

import splunklib.results as results

kwargs_oneshot = {"earliest_time": "2014-06-19T12:00:00.000-07:00",
"latest_time": "2014-06-20T12:00:00.000-07:00"}
searchquery_oneshot = "index=SearcherIndex NOT "health" | stats count"

oneshotsearch_results = service.jobs.oneshot(searchquery_oneshot, **kwargs_oneshot)

Get the results and display them using the ResultsReader

reader = results.ResultsReader(oneshotsearch_results)
for item in reader:
print(item)

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...