REST API Incomplete Results

[vvvinamer]

Getting incomplete (lesser number of events as results ) when using rest API. The same search i run in the splunk enterprise gives 90 events always, but the splunk api returning only 12-14 events(varying). Both the searches have earliest_time=-1d and the exec_mode is oneshot, so i am getting the results back then only.

Here i was using search/jobs api and oneshot mode, so the reuslts were incomplete. I read somewhere and rather used post:search/jobs, get: search/jobs/{sid} in a while loop and then retrieved results, but the results still are incomplete.

Cant  seem to find a solution, would be great if anyone could help, my search looks like this, although not sure if it matters.

index="val" [search index="val" field1="val2"   |  dedup  field2  |  format]  eventstats count by field2

[arjunpkishore5]

Try adding attribute count=0 to you rest query

https://<host>:<mPort>/services/search/jobs?sid=<sid>&count=0

[vvvinamer]

Screenshot (7).png

Thanks for replying but, tried adding that but no change, this time the actual search(a different search than my post) on splunk generated 147 events whereas splunk api got 62 events. Also my search is oneshot and i wasnt able to find the count field in search/jobs post methods. 

[jkat54]

are you adding earliest=-24h to your search in the UI or are you using the time picker to select last 24h?  

try explicitly adding it to your UI search to see if that makes a difference.

also, verify you are dispatching the REST search in the same app & user context.  Use servicesNS endpoints to do that. 

[jkat54]

Post the search to

https://<host>:<mPort>/servicesNS/userName/appName/search