Different results when search is run in web UI then in python script.

[tbeason]

When I run this search in the Web UI I get the correct results.  When it is run in a python script the "count(eval(RequestTime<2.00)) as PlaybackNumSuccessful" returns 0 when it should not.

search index=cdvr host=* AND source="/var/log/nginx/access.log" AND sourcetype="gemini-ecdn-nginx-access"
| rex field=_raw ".*?\t.*?\t.*?\t.*?\t(?<Method>\w+)\s/(?<URI>.+?)\sHTTP.+?\t.*?\t(?<Status>.+?)\t.*?\t.*?\t.*?\t.*?\s.*?\t.*?\t(?<host_header>.+?)\t"
        | rex field=URI "(?<RecordingID>.*)\.(?<resource>.*)?\?.*"
        | dedup RecordingID
        | search Method=GET resource="m3u8"
        | stats
        count(eval(RequestTime<2.00)) as PlaybackNumSuccessful
        count(eval(RecordingID)) as PlaybackNumTotal
        | eval PlaybackNumFailed=(PlaybackNumTotal-PlaybackNumSuccessful)
        | eval SuccessPer = (PlaybackNumSuccessful/PlaybackNumTotal)*100
        | eval PlaybackLatencyLessThan2SecSuccessRate=round(SuccessPer, 3)."%"
        | fields PlaybackNumTotal PlaybackNumFailed PlaybackLatencyLessThan2SecSuccessRate

Any ideas why?

[DalJeanis]

There are a number of things I'd check.  Python is finicky about indentation, so I'd probably write a python script with a cut-back version of the SPL to make sure what the values are immediately before the stats command, if none of the following fix it.

Here are some ideas - 

1) Run the stats together on one line.

2) Put quotes around GET

3) Use tonumber to force RequestTime to be a number, in case for some reason it is being evaluated as a string.

4) Make sure that all lines are at the same indentation.

5) Add commas between each clause in the stats line.

search index=cdvr host=* AND source="/var/log/nginx/access.log" AND sourcetype="gemini-ecdn-nginx-access"
| rex field=_raw ".*?\t.*?\t.*?\t.*?\t(?<Method>\w+)\s/(?<URI>.+?)\sHTTP.+?\t.*?\t(?<Status>.+?)\t.*?\t.*?\t.*?\t.*?\s.*?\t.*?\t(?<host_header>.+?)\t"
        | rex field=URI "(?<RecordingID>.*)\.(?<resource>.*)?\?.*"
        | dedup RecordingID
        | search Method="GET" resource="m3u8"
        | stats count(eval(tonumber(RequestTime)<2.00)) as PlaybackNumSuccessful count(eval(RecordingID)) as PlaybackNumTotal
        | eval PlaybackNumFailed=(PlaybackNumTotal-PlaybackNumSuccessful)
        | eval SuccessPer = (PlaybackNumSuccessful/PlaybackNumTotal)*100
        | eval PlaybackLatencyLessThan2SecSuccessRate=round(SuccessPer, 3)."%"
        | fields PlaybackNumTotal PlaybackNumFailed PlaybackLatencyLessThan2SecSuccessRate

There's one further thing to try ...

        | stats sum(eval(case(tonumber(RequestTime)<2.00,1, true(),0))) as PlaybackNumSuccessful, sum(eval(case(tonumber(RequestTime)>=2.00,1,true(),0))) as PlaybackNumLong, sum(eval(case(isnull(RequestTime),1, true(),0))) as PlaybackNumNull, count(eval(RecordingID)) as PlaybackNumTotal

That will give you  information about whether the RequestTime field is being interpreted incorrectly or not recognized at all.  

[tbeason]

What ended up making the search work from python was to explicitly add "RequestTime" to the regex.  For some reason it worked without it on the web UI.

rex field=_raw ".*?\\t.*?\\t.*?\\t.*?\t(?<Method>\w+)\s/(?<URI>.+?)\sHTTP.+?\\t.*?\\t(?<Status>.+?)\\t.*?\\t.*?\\t.*?\\t.*?\\t(?<RequestTime>.+?)\s"

[bowesmana]

Is the time range different in each search? In the UI, the time would be applicable to the time zone of the UI, if your timestamps are in UTC for eaxmple.

Whereas, I'm not sure how the timezone for the search would be interpreted running as the Python script, but probably the system time zone.

Not sure if this will help, but I have had a similar issue with different results for different searches based on time zone settings.