Mismatch in Stats UI & Splunk API

sugankrish88 — Tue, 29 Dec 2020 13:30:02 GMT

index=<<My_index>> earliest="12/23/2020:10:00:00" latest="12/23/2020:11:00:00" "<<url>>" | eval MyFeild=replace(MyFeild,"\d{1}\d+","") | search MyFeild=*sample_search* | stats count by MyFeild

When I have been using the above search criteria in UI , it gives the a table in Statistics tab with

MyFeild and its total Count

when I am using the splunkapi for some reason I am not getting the consolidated ouput

https://<<mydomain for my splunkapi>>/services/search/jobs/export?search=search index=<<My_index>> earliest="12/23/2020:10:00:00" latest="12/23/2020:11:00:00" "<<url>>" | eval MyFeild=replace(MyFeild,"\d{1}\d+","") | search MyFeild=*sample_search* | stats count by MyFeild

Not sure If I am missing anything here

Re: Mismatch in Stats UI & Splunk API

richgalloway — Tue, 29 Dec 2020 13:31:44 GMT

You say you don't get the "consolidate output", but what do you get? Why are you trying to remove numerical data from the URL? Are you authenticating in your request? Are you encoding the URL before sending it?

Please share the full API request.

topic Re: Mismatch in Stats UI & Splunk API in Splunk Search

Mismatch in Stats UI & Splunk API

Re: Mismatch in Stats UI & Splunk API