Splunk Search

Why is my Fast mode search submitted via Python SDK being executed in Verbose mode?

sl4dy
Explorer

I have submitted the following query via Python SDK:

earliest=-1d@d latest=@d | eval size_B=len(_raw) | eval mytime=strftime(_time, "%Y-%m-%d") | fillnull value="NA" component, gcf_event, task_type, subtype | stats sum(size_B) as totalSize by mytime, source, host, component, gcf_event, task_type, subtype, index | eval totalSizeGB = totalSize/1024/1024/1024

When I check it in Jobs (screenshot attached), I see it as Fast mode, however, it is actually Verbose mode as the events are being gathered and the performance is really degraded compared to "real" Fast mode. How can I ensure that the query is really executed in Fast mode?

alt text

0 Karma
1 Solution

sl4dy
Explorer

This is caused by the fact that parameter status_buckets is not set to 0 when the search query is submitted via SDK. When the query is submitted in UI it is set to 0. It can be checked in "Inspect Job". The explanation for this setting can be found here.

To set it in Python SDK:

kwargs_normalsearch = {"exec_mode": "normal", 'status_buckets': '0', 'timeout': '6000'}
job = service.jobs.create(searchquery_normal, **kwargs_normalsearch)

View solution in original post

0 Karma

sl4dy
Explorer

This is caused by the fact that parameter status_buckets is not set to 0 when the search query is submitted via SDK. When the query is submitted in UI it is set to 0. It can be checked in "Inspect Job". The explanation for this setting can be found here.

To set it in Python SDK:

kwargs_normalsearch = {"exec_mode": "normal", 'status_buckets': '0', 'timeout': '6000'}
job = service.jobs.create(searchquery_normal, **kwargs_normalsearch)
0 Karma

alancalvitti
Path Finder

@sl4dy, will 'status_buckets':0 also work in jobs.export(...) , ie by adding that option to the typical kwargs:

{'search_mode': 'normal', 'output_mode':'json, 'count':0, 'preview': False}?

-as well as time spec? 

 

 

 

 

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

Which version of Splunk are you on?

0 Karma

sl4dy
Explorer

Splunk Version
6.0.3
Splunk Build
204106

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...