When I run the query search index=* sourcetype="XXX" earliest=-7d@d latest=-6d@d | stats count via the REST API, I get a count of 2752. (Note: I'm using the Python requests library to submit the query.) However, when I run the exact same query via the Splunk GUI, I get a count of 197395.
I realize that my problem is similar to the one explored in this question: https://answers.splunk.com/answers/25431/inconsistency-between-splunk-api-vs-gui-search-results.html.... However, I use the | stats count and results endpoint approach suggested by that answer. Also, even if the count was also being capped at 100000 events as happens with the eventCount property, the count is still far below 100000. Thus, my problem must have a different cause.
Thanks!
