topic Re: Why is my Fast mode search submitted via Python SDK being executed in Verbose mode? in Splunk Search

Why is my Fast mode search submitted via Python SDK being executed in Verbose mode?

sl4dy — Wed, 06 Jan 2016 12:00:41 GMT

I have submitted the following query via Python SDK:

earliest=-1d@d latest=@d | eval size_B=len(_raw) | eval mytime=strftime(_time, "%Y-%m-%d") | fillnull value="NA" component, gcf_event, task_type, subtype | stats sum(size_B) as totalSize by mytime, source, host, component, gcf_event, task_type, subtype, index | eval totalSizeGB = totalSize/1024/1024/1024

When I check it in Jobs (screenshot attached), I see it as Fast mode, however, it is actually Verbose mode as the events are being gathered and the performance is really degraded compared to "real" Fast mode. How can I ensure that the query is really executed in Fast mode?

Re: Why is my Fast mode search submitted via Python SDK being executed in Verbose mode?

aljohnson_splun — Wed, 06 Jan 2016 21:26:06 GMT

Which version of Splunk are you on?

Re: Why is my Fast mode search submitted via Python SDK being executed in Verbose mode?

sl4dy — Thu, 07 Jan 2016 20:38:31 GMT

Splunk Version
6.0.3
Splunk Build
204106

Re: Why is my Fast mode search submitted via Python SDK being executed in Verbose mode?

sl4dy — Wed, 13 Jan 2016 13:00:02 GMT

This is caused by the fact that parameter status_buckets is not set to 0 when the search query is submitted via SDK. When the query is submitted in UI it is set to 0. It can be checked in "Inspect Job". The explanation for this setting can be found here.

To set it in Python SDK:

kwargs_normalsearch = {"exec_mode": "normal", 'status_buckets': '0', 'timeout': '6000'}
job = service.jobs.create(searchquery_normal, **kwargs_normalsearch)

Re: Why is my Fast mode search submitted via Python SDK being executed in Verbose mode?

alancalvitti — Mon, 03 May 2021 19:20:36 GMT

@sl4dy, will 'status_buckets':0 also work in jobs.export(...) , ie by adding that option to the typical kwargs:

{'search_mode': 'normal', 'output_mode':'json, 'count':0, 'preview': False}?

-as well as time spec?