Splunk Dev

Python SDK resulting in split values for stats

brajaram
Communicator

We're currently using the python sdk to hit the API to run some queries. These are all stats functions to generate metrics for our systems every week. We're running into a strange issue where Splunk is returning the correct values, but splitting them up into multiple fields.

Expected Data (And what we see in splunk web)

ServiceName                TotalCount                    ResponseTime
PingService                   100,000                          10ms

What we actually get is something like this

ServiceName                 TotalCount                ResponseTime
PingService                    99,987                        10ms
PingService                        13                        14ms

The total sum ends up being correct, but for some reason it is splitting up the events into separate rows. What could be causing this issue?

The code we use to hit the SDK is as follows:

HOST = 
PORT = 
USERNAME = 
PASSWORD = 
APPLICATION = 
service = client.connect(
        host = HOST,
        port = PORT,
        username = USERNAME,
        password = PASSWORD)

kwargs_export = {"earliest_time": "-170hour", 
              "latest_time": "-2hour", 
                "search_mode": "normal", 
                "count" : 0} 

searchquery_export = 'long query ending with stats'
job = service.jobs.create(searchquery_export, **kwargs_export)

#While Loop to check and print the status of the job - code cut for brevity


reader = results.ResultsReader(job.results(**kwargs_export))    

reultList = []
for result in reader:
    if isinstance(result, dict):
        resultDict=dict(result)
        reultList.append(resultDict)
job.cancel()
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...