I get a different result set when using jobs.export of python SDK with a simple stats query compared to the same query (and time range) on the splunk UI.
the jobs.export returns a list of results of the following form, so there is a repeating pattern with several sets of "lastrow":true and repeating "offset" almost as if partial results are included several times.
Only the last set matches the final results of the query on the UI.
Schematically the results of this call:
jobs.export("search my_id | stats count by index").read().decode('utf8').split('\n')
have this form
['{"preview":true, "offset":0, "result": {"index": "index_a", "count":"2"}}',
'{"preview":true, "offset":1, "result": {"index": "index_b", "count":"4"}}',
'{"preview":true, "offset":2, "lastrow":true, "result": {"index": "index_b", "count":"4"}}',
'{"preview":true, "offset":0, "result": {"index": "index_a", "count":"6"}}',
'{"preview":true, "offset":1, "result": {"index": "index_b", "count":"12"}}',
'{"preview":true, "offset":2, "lastrow":true, "result": {"index": "index_b", "count":"50"}}',
'{"preview":true, "offset":0, "result": {"index": "index_a", "count":"18"}}',
'{"preview":true, "offset":1, "result": {"index": "index_b", "count":"102"}}',
'{"preview":true, "offset":2, "lastrow":true, "result": {"index": "index_b", "count":"499"}}',
'{"preview":true, "offset":0, "result": {"index": "index_a", "count":"18"}}',
'{"preview":true, "offset":1, "result": {"index": "index_b", "count":"102"}}',
'{"preview":true, "offset":2, "lastrow":true, "result": {"index": "index_b", "count":"499"}}',
]
the last couple of segments ending with "lastrow":true share the same count that matches that in the UI.
Is there some flag we need to insert in kwargs? currently using only earliest_time, latest_time, count:0 and sample_ratio:1
