Splunk Search

Why does stats via python SDK export returns multiple sets of results?

alancalvitti
Path Finder

I get a different result set when using jobs.export of python SDK with a simple stats query compared to the same query (and time range) on the splunk UI. 

the jobs.export returns a list of results of the following form, so there is a repeating pattern with several sets of "lastrow":true  and repeating "offset" almost as if partial results are included several times. 

Only the last set matches the final results of the query on the UI. 

Schematically the results of this call:

jobs.export("search my_id | stats count by index").read().decode('utf8').split('\n')

have this form

['{"preview":true, "offset":0, "result": {"index": "index_a", "count":"2"}}',

'{"preview":true, "offset":1, "result": {"index": "index_b", "count":"4"}}',

'{"preview":true, "offset":2, "lastrow":true, "result": {"index": "index_b", "count":"4"}}',

'{"preview":true, "offset":0, "result": {"index": "index_a", "count":"6"}}',

'{"preview":true, "offset":1, "result": {"index": "index_b", "count":"12"}}',

'{"preview":true, "offset":2, "lastrow":true, "result": {"index": "index_b", "count":"50"}}',

'{"preview":true, "offset":0, "result": {"index": "index_a", "count":"18"}}',

'{"preview":true, "offset":1, "result": {"index": "index_b", "count":"102"}}',

'{"preview":true, "offset":2, "lastrow":true, "result": {"index": "index_b", "count":"499"}}',

'{"preview":true, "offset":0, "result": {"index": "index_a", "count":"18"}}',

'{"preview":true, "offset":1, "result": {"index": "index_b", "count":"102"}}',

'{"preview":true, "offset":2, "lastrow":true, "result": {"index": "index_b", "count":"499"}}',

]

the last couple of segments ending with "lastrow":true share the same count that matches that in the UI.  

Is there some flag we need to insert in kwargs? currently using only earliest_time, latest_time, count:0 and sample_ratio:1

Labels (2)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...