Splunk Search

Why is my Fast mode search submitted via Python SDK being executed in Verbose mode?

sl4dy
Explorer

I have submitted the following query via Python SDK:

earliest=-1d@d latest=@d | eval size_B=len(_raw) | eval mytime=strftime(_time, "%Y-%m-%d") | fillnull value="NA" component, gcf_event, task_type, subtype | stats sum(size_B) as totalSize by mytime, source, host, component, gcf_event, task_type, subtype, index | eval totalSizeGB = totalSize/1024/1024/1024

When I check it in Jobs (screenshot attached), I see it as Fast mode, however, it is actually Verbose mode as the events are being gathered and the performance is really degraded compared to "real" Fast mode. How can I ensure that the query is really executed in Fast mode?

alt text

0 Karma
1 Solution

sl4dy
Explorer

This is caused by the fact that parameter status_buckets is not set to 0 when the search query is submitted via SDK. When the query is submitted in UI it is set to 0. It can be checked in "Inspect Job". The explanation for this setting can be found here.

To set it in Python SDK:

kwargs_normalsearch = {"exec_mode": "normal", 'status_buckets': '0', 'timeout': '6000'}
job = service.jobs.create(searchquery_normal, **kwargs_normalsearch)

View solution in original post

0 Karma

sl4dy
Explorer

This is caused by the fact that parameter status_buckets is not set to 0 when the search query is submitted via SDK. When the query is submitted in UI it is set to 0. It can be checked in "Inspect Job". The explanation for this setting can be found here.

To set it in Python SDK:

kwargs_normalsearch = {"exec_mode": "normal", 'status_buckets': '0', 'timeout': '6000'}
job = service.jobs.create(searchquery_normal, **kwargs_normalsearch)
0 Karma

alancalvitti
Path Finder

@sl4dy, will 'status_buckets':0 also work in jobs.export(...) , ie by adding that option to the typical kwargs:

{'search_mode': 'normal', 'output_mode':'json, 'count':0, 'preview': False}?

-as well as time spec? 

 

 

 

 

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Which version of Splunk are you on?

0 Karma

sl4dy
Explorer

Splunk Version
6.0.3
Splunk Build
204106

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

Stay Connected: Your Guide to August Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Unleash the Power of Splunk MCP and AI, Meet Us at .Conf 2025, and Find Even More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...