Splunk Dev

Python SDK resulting in split values for stats

brajaram
Communicator

We're currently using the python sdk to hit the API to run some queries. These are all stats functions to generate metrics for our systems every week. We're running into a strange issue where Splunk is returning the correct values, but splitting them up into multiple fields.

Expected Data (And what we see in splunk web)

ServiceName                TotalCount                    ResponseTime
PingService                   100,000                          10ms

What we actually get is something like this

ServiceName                 TotalCount                ResponseTime
PingService                    99,987                        10ms
PingService                        13                        14ms

The total sum ends up being correct, but for some reason it is splitting up the events into separate rows. What could be causing this issue?

The code we use to hit the SDK is as follows:

HOST = 
PORT = 
USERNAME = 
PASSWORD = 
APPLICATION = 
service = client.connect(
        host = HOST,
        port = PORT,
        username = USERNAME,
        password = PASSWORD)

kwargs_export = {"earliest_time": "-170hour", 
              "latest_time": "-2hour", 
                "search_mode": "normal", 
                "count" : 0} 

searchquery_export = 'long query ending with stats'
job = service.jobs.create(searchquery_export, **kwargs_export)

#While Loop to check and print the status of the job - code cut for brevity


reader = results.ResultsReader(job.results(**kwargs_export))    

reultList = []
for result in reader:
    if isinstance(result, dict):
        resultDict=dict(result)
        reultList.append(resultDict)
job.cancel()
0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...