Developing for Splunk Enterprise
Highlighted

Splunk Python SDK: Mismatch Results

New Member

I am using Splunk Python SDK to run series of splunk queries. Recently encountered an issue, results from SDK and manually running query on the Web yields different results. All I am trying to do is run a simple query to get the count for a particular timeframe(index=xxx | stats count). I see SDK query result count is short of 1 million than the one executed manually. I did verify the timeframe is same in both the case. Could someone shed some light?

Labels (2)
0 Karma
Highlighted

Re: Splunk Python SDK: Mismatch Results

SplunkTrust
SplunkTrust

Please post both the manual search and the code used with the sdk to create the search via API.

Please be sure the user executing the search is the same.

Please verify the job properties match between both jobs. (Open splunk UI -> Activity -> Jobs -> find your job -> click job drop down -> inspect job)

0 Karma
Highlighted

Re: Splunk Python SDK: Mismatch Results

New Member

I am exactly doing the same as below.. Running the same query manually I get 5 Million as Total count but running through the below code returns only 4 Million as Total count.

import splunklib.results as results

kwargsoneshot = {"earliesttime": "2014-06-19T12:00:00.000-07:00",
"latesttime": "2014-06-20T12:00:00.000-07:00"}
searchquery
oneshot = "index=SearcherIndex NOT "health" | stats count"

oneshotsearchresults = service.jobs.oneshot(searchqueryoneshot, **kwargs_oneshot)

Get the results and display them using the ResultsReader

reader = results.ResultsReader(oneshotsearch_results)
for item in reader:
print(item)

0 Karma
Highlighted

Re: Splunk Python SDK: Mismatch Results

Explorer

Try adding the following arguments in the kwargs dictionary:

"count" : 0

This will not limit your results if a limit exists somewhere.

0 Karma