https://community.splunk.com/t5/Splunk-Search/Why-does-stats-via-python-SDK-export-returns-multiple-sets-of/m-p/536897#M151777 <P>I get a different result set when using <EM>jobs.export</EM> of python SDK with a simple stats query compared to the same query (and time range) on the splunk UI.&nbsp;</P> <P>the jobs.export returns a list of results of the following form, so there is a repeating pattern with several sets of "lastrow":true&nbsp; and repeating "offset" almost as if partial results are included several times.&nbsp;</P> <P>Only the last set matches the final results of the query on the UI.&nbsp;</P> <P>Schematically the results of this call:</P> <P>jobs.export("search my_id | stats count by index").read().decode('utf8').split('\n')</P> <P>have this form</P> <LI-CODE lang="markup">['{"preview":true, "offset":0, "result": {"index": "index_a", "count":"2"}}', '{"preview":true, "offset":1, "result": {"index": "index_b", "count":"4"}}', '{"preview":true, "offset":2, "lastrow":true, "result": {"index": "index_b", "count":"4"}}', '{"preview":true, "offset":0, "result": {"index": "index_a", "count":"6"}}', '{"preview":true, "offset":1, "result": {"index": "index_b", "count":"12"}}', '{"preview":true, "offset":2, "lastrow":true, "result": {"index": "index_b", "count":"50"}}', '{"preview":true, "offset":0, "result": {"index": "index_a", "count":"18"}}', '{"preview":true, "offset":1, "result": {"index": "index_b", "count":"102"}}', '{"preview":true, "offset":2, "lastrow":true, "result": {"index": "index_b", "count":"499"}}', '{"preview":true, "offset":0, "result": {"index": "index_a", "count":"18"}}', '{"preview":true, "offset":1, "result": {"index": "index_b", "count":"102"}}', '{"preview":true, "offset":2, "lastrow":true, "result": {"index": "index_b", "count":"499"}}', ]</LI-CODE> <P>the last couple of segments ending with "lastrow":true share the same count that matches that in the UI.&nbsp;&nbsp;</P> <P>Is there some flag we need to insert in kwargs? currently using only earliest_time, latest_time, count:0 and sample_ratio:1</P> Sat, 23 Jan 2021 05:37:27 GMT alancalvitti 2021-01-23T05:37:27Z https://community.splunk.com/t5/Splunk-Search/Why-does-stats-via-python-SDK-export-returns-multiple-sets-of/m-p/536897#M151777 <P>I get a different result set when using <EM>jobs.export</EM> of python SDK with a simple stats query compared to the same query (and time range) on the splunk UI.&nbsp;</P> <P>the jobs.export returns a list of results of the following form, so there is a repeating pattern with several sets of "lastrow":true&nbsp; and repeating "offset" almost as if partial results are included several times.&nbsp;</P> <P>Only the last set matches the final results of the query on the UI.&nbsp;</P> <P>Schematically the results of this call:</P> <P>jobs.export("search my_id | stats count by index").read().decode('utf8').split('\n')</P> <P>have this form</P> <LI-CODE lang="markup">['{"preview":true, "offset":0, "result": {"index": "index_a", "count":"2"}}', '{"preview":true, "offset":1, "result": {"index": "index_b", "count":"4"}}', '{"preview":true, "offset":2, "lastrow":true, "result": {"index": "index_b", "count":"4"}}', '{"preview":true, "offset":0, "result": {"index": "index_a", "count":"6"}}', '{"preview":true, "offset":1, "result": {"index": "index_b", "count":"12"}}', '{"preview":true, "offset":2, "lastrow":true, "result": {"index": "index_b", "count":"50"}}', '{"preview":true, "offset":0, "result": {"index": "index_a", "count":"18"}}', '{"preview":true, "offset":1, "result": {"index": "index_b", "count":"102"}}', '{"preview":true, "offset":2, "lastrow":true, "result": {"index": "index_b", "count":"499"}}', '{"preview":true, "offset":0, "result": {"index": "index_a", "count":"18"}}', '{"preview":true, "offset":1, "result": {"index": "index_b", "count":"102"}}', '{"preview":true, "offset":2, "lastrow":true, "result": {"index": "index_b", "count":"499"}}', ]</LI-CODE> <P>the last couple of segments ending with "lastrow":true share the same count that matches that in the UI.&nbsp;&nbsp;</P> <P>Is there some flag we need to insert in kwargs? currently using only earliest_time, latest_time, count:0 and sample_ratio:1</P> Sat, 23 Jan 2021 05:37:27 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-stats-via-python-SDK-export-returns-multiple-sets-of/m-p/536897#M151777 alancalvitti 2021-01-23T05:37:27Z