Splunk Dev

Splunk Python SDK: Mismatch Results

kavithaisplunk
New Member

I am using Splunk Python SDK to run series of splunk queries. Recently encountered an issue, results from SDK and manually running query on the Web yields different results. All I am trying to do is run a simple query to get the count for a particular timeframe(index=xxx | stats count). I see SDK query result count is short of 1 million than the one executed manually. I did verify the timeframe is same in both the case. Could someone shed some light?

Labels (2)
0 Karma

raduurjan
Explorer

Try adding the following arguments in the kwargs dictionary:

"count" : 0

This will not limit your results if a limit exists somewhere.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Please post both the manual search and the code used with the sdk to create the search via API.

Please be sure the user executing the search is the same.

Please verify the job properties match between both jobs. (Open splunk UI -> Activity -> Jobs -> find your job -> click job drop down -> inspect job)

0 Karma

kavithaisplunk
New Member

I am exactly doing the same as below.. Running the same query manually I get 5 Million as Total count but running through the below code returns only 4 Million as Total count.

import splunklib.results as results

kwargs_oneshot = {"earliest_time": "2014-06-19T12:00:00.000-07:00",
"latest_time": "2014-06-20T12:00:00.000-07:00"}
searchquery_oneshot = "index=SearcherIndex NOT "health" | stats count"

oneshotsearch_results = service.jobs.oneshot(searchquery_oneshot, **kwargs_oneshot)

Get the results and display them using the ResultsReader

reader = results.ResultsReader(oneshotsearch_results)
for item in reader:
print(item)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...