Why the same query returning different results on REST?

[goudas]

The following query return the expected result on Postman but return a different result on Javacsript fetch:

search host="hydra-notifications-engine-prod*" index="federated:rh_jboss" "notifications-engine ReportProcessor :" | eval chartingField=case(match(_raw,"Channel\s*EMAIL \|"),"Email",match(_raw,"Channel\s*GOOGLECHAT \|"),"Google Chat",match(_raw,"Channel\s*IRC \|"),"IRC",match(_raw,"Channel\s*SLACK \|"),"Slack",match(_raw,"Channel\s*SMS \|"),"SMS") |timechart span="1d" count by chartingField

What is issue?

[livehybrid]

Hi @goudas 

The discrepancy likely stems from differences in the search execution context between Postman and your JavaScript fetch call, such as the timeframe used for the search job or the app context. When not explicitly defined in the API request, Splunk might use default values that could differ based on user settings or how the API call is authenticated.

Ensure you are searching the same earliest and latest time, and that you are using the same app context between your WebUI searches and API searches.

Also, check that any backslashes/quotes etc are appropriately handled in your API requests. 

To investigate any differences, in the web UI go to Activity (top right) -> Jobs to open the Job Manager and then locate the two searches - check that the search, earliest/latest/app all match. This should hopefully highlight if there is a discrepancy.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[ITWhisperer]

How are the results different? What do you get? What were you expecting? Could it do with using backslashes? Can you get the results you were expecting by adding additional backslashes?