https://community.splunk.com/t5/Splunk-Search/REST-query-via-console-vs-API-showing-different-results/m-p/756520#M243108 <P>Executive overview: We're using Splunk Cloud (Victoria Experience), and we're in the process of spinning up a new instance for FedRAMP purposes.</P><P>One thing I'm trying to do is streamline migrating of some of our custom sourcetypes from the existing environment to the new one. I'm able to perform a search via the console that returns a record containing all the details of a given sourcetype (This particular sourcetype has a few dozen EVAL-*, FIELDALIAS-*, and LOOKUP-* settings, so it's a pretty complex one.):<BR /><BR /></P><LI-CODE lang="markup">| rest /services/configs/conf-props | search title="sfdc:logfile"</LI-CODE><P>&nbsp;</P><P>If I try the above search via a POST to&nbsp;<FONT color="#FF0000">/services/search/v2/jobs/export</FONT> (or the&nbsp;<FONT color="#FF0000">/servicesNS</FONT> equivalent with either <FONT color="#FF0000">-</FONT> wildcards or an explicit user &amp; app) I don't get any of those EVAL-* etc. settings. The authentication token I'm using for the search was created by an admin user, and I've tried using that same admin user on the&nbsp;<FONT color="#FF0000">/servicesNS</FONT>&nbsp; requests. Why am I only getting partial results via the API?</P> Mon, 15 Dec 2025 15:04:51 GMT bpenny 2025-12-15T15:04:51Z https://community.splunk.com/t5/Splunk-Search/REST-query-via-console-vs-API-showing-different-results/m-p/756520#M243108 <P>Executive overview: We're using Splunk Cloud (Victoria Experience), and we're in the process of spinning up a new instance for FedRAMP purposes.</P><P>One thing I'm trying to do is streamline migrating of some of our custom sourcetypes from the existing environment to the new one. I'm able to perform a search via the console that returns a record containing all the details of a given sourcetype (This particular sourcetype has a few dozen EVAL-*, FIELDALIAS-*, and LOOKUP-* settings, so it's a pretty complex one.):<BR /><BR /></P><LI-CODE lang="markup">| rest /services/configs/conf-props | search title="sfdc:logfile"</LI-CODE><P>&nbsp;</P><P>If I try the above search via a POST to&nbsp;<FONT color="#FF0000">/services/search/v2/jobs/export</FONT> (or the&nbsp;<FONT color="#FF0000">/servicesNS</FONT> equivalent with either <FONT color="#FF0000">-</FONT> wildcards or an explicit user &amp; app) I don't get any of those EVAL-* etc. settings. The authentication token I'm using for the search was created by an admin user, and I've tried using that same admin user on the&nbsp;<FONT color="#FF0000">/servicesNS</FONT>&nbsp; requests. Why am I only getting partial results via the API?</P> Mon, 15 Dec 2025 15:04:51 GMT https://community.splunk.com/t5/Splunk-Search/REST-query-via-console-vs-API-showing-different-results/m-p/756520#M243108 bpenny 2025-12-15T15:04:51Z https://community.splunk.com/t5/Splunk-Search/REST-query-via-console-vs-API-showing-different-results/m-p/756531#M243109 <P>Turns out this was user error due to not parsing the results properly.</P> Mon, 15 Dec 2025 18:57:45 GMT https://community.splunk.com/t5/Splunk-Search/REST-query-via-console-vs-API-showing-different-results/m-p/756531#M243109 bpenny 2025-12-15T18:57:45Z