topic Re: REST API Incomplete Results in Splunk Search

REST API Incomplete Results

vvvinamer — Wed, 22 Jul 2020 07:15:22 GMT

Getting incomplete (lesser number of events as results ) when using rest API. The same search i run in the splunk enterprise gives 90 events always, but the splunk api returning only 12-14 events(varying). Both the searches have earliest_time=-1d and the exec_mode is oneshot, so i am getting the results back then only.

Here i was using search/jobs api and oneshot mode, so the reuslts were incomplete. I read somewhere and rather used post:search/jobs, get: search/jobs/{sid} in a while loop and then retrieved results, but the results still are incomplete.

Cant seem to find a solution, would be great if anyone could help, my search looks like this, although not sure if it matters.

index="val" [search index="val" field1="val2" | dedup field2 | format] eventstats count by field2

Re: REST API Incomplete Results

arjunpkishore5 — Sat, 18 Jul 2020 15:32:21 GMT

Try adding attribute count=0 to you rest query

https://<host>:<mPort>/services/search/jobs?sid=<sid>&count=0

Re: REST API Incomplete Results

vvvinamer — Sat, 18 Jul 2020 16:06:53 GMT

Thanks for replying but, tried adding that but no change, this time the actual search(a different search than my post) on splunk generated 147 events whereas splunk api got 62 events. Also my search is oneshot and i wasnt able to find the count field in search/jobs post methods.

Re: REST API Incomplete Results

jkat54 — Wed, 22 Jul 2020 10:58:12 GMT

are you adding earliest=-24h to your search in the UI or are you using the time picker to select last 24h?

try explicitly adding it to your UI search to see if that makes a difference.

also, verify you are dispatching the REST search in the same app & user context. Use servicesNS endpoints to do that.

Re: REST API Incomplete Results

jkat54 — Wed, 22 Jul 2020 11:02:34 GMT

Post the search to

https://<host>:<mPort>/servicesNS/userName/appName/search