Why is my Fast mode search submitted via Python SDK being executed in Verbose mode?

[sl4dy]

I have submitted the following query via Python SDK:

earliest=-1d@d latest=@d | eval size_B=len(_raw) | eval mytime=strftime(_time, "%Y-%m-%d") | fillnull value="NA" component, gcf_event, task_type, subtype | stats sum(size_B) as totalSize by mytime, source, host, component, gcf_event, task_type, subtype, index | eval totalSizeGB = totalSize/1024/1024/1024

When I check it in Jobs (screenshot attached), I see it as Fast mode, however, it is actually Verbose mode as the events are being gathered and the performance is really degraded compared to "real" Fast mode. How can I ensure that the query is really executed in Fast mode?

[sl4dy · Accepted solution]

This is caused by the fact that parameter status_buckets is not set to 0 when the search query is submitted via SDK. When the query is submitted in UI it is set to 0. It can be checked in "Inspect Job". The explanation for this setting can be found here.

To set it in Python SDK:

kwargs_normalsearch = {"exec_mode": "normal", 'status_buckets': '0', 'timeout': '6000'}
job = service.jobs.create(searchquery_normal, **kwargs_normalsearch)

[alancalvitti]

@sl4dy, will 'status_buckets':0 also work in jobs.export(...) , ie by adding that option to the typical kwargs:

{'search_mode': 'normal', 'output_mode':'json, 'count':0, 'preview': False}?

-as well as time spec? 

[aljohnson_splun]

Which version of Splunk are you on?

[sl4dy]

Splunk Version
6.0.3
Splunk Build
204106