Splunk Dev

Python SDK resulting in split values for stats

brajaram
Communicator

We're currently using the python sdk to hit the API to run some queries. These are all stats functions to generate metrics for our systems every week. We're running into a strange issue where Splunk is returning the correct values, but splitting them up into multiple fields.

Expected Data (And what we see in splunk web)

ServiceName                TotalCount                    ResponseTime
PingService                   100,000                          10ms

What we actually get is something like this

ServiceName                 TotalCount                ResponseTime
PingService                    99,987                        10ms
PingService                        13                        14ms

The total sum ends up being correct, but for some reason it is splitting up the events into separate rows. What could be causing this issue?

The code we use to hit the SDK is as follows:

HOST = 
PORT = 
USERNAME = 
PASSWORD = 
APPLICATION = 
service = client.connect(
        host = HOST,
        port = PORT,
        username = USERNAME,
        password = PASSWORD)

kwargs_export = {"earliest_time": "-170hour", 
              "latest_time": "-2hour", 
                "search_mode": "normal", 
                "count" : 0} 

searchquery_export = 'long query ending with stats'
job = service.jobs.create(searchquery_export, **kwargs_export)

#While Loop to check and print the status of the job - code cut for brevity


reader = results.ResultsReader(job.results(**kwargs_export))    

reultList = []
for result in reader:
    if isinstance(result, dict):
        resultDict=dict(result)
        reultList.append(resultDict)
job.cancel()
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...