Splunk Search

Why do the REST API and Splunk GUI give different results for the same query?

btoomey
New Member

When I run the query search index=* sourcetype="XXX" earliest=-7d@d latest=-6d@d | stats count via the REST API, I get a count of 2752. (Note: I'm using the Python requests library to submit the query.) However, when I run the exact same query via the Splunk GUI, I get a count of 197395.

I realize that my problem is similar to the one explored in this question: https://answers.splunk.com/answers/25431/inconsistency-between-splunk-api-vs-gui-search-results.html.... However, I use the | stats count and results endpoint approach suggested by that answer. Also, even if the count was also being capped at 100000 events as happens with the eventCount property, the count is still far below 100000. Thus, my problem must have a different cause.

Thanks!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...