Hi, we're using Splunk SDK to do regular exports of data (as a CSV file). We've been using regular search jobs some time ago and that worked fine except that it was rather difficult to fetch results with more than 50.000 rows - we had to fetch it piece by piece. Recently we switched to search/jobs/export endpoint which is much easier to use, but it seems to rearrange the columns for some queries - for example the query ends with "table A,B,C" but the resulting CSV is "C,A,B". This makes the processing of the exported data very difficult. Why is this happening and how to make it stop? I've found several questions here, but none with an answer or an explanation why it happens. I've also searched the docs for info about this behavior without success. ... View more

Our logs contain some multi-line messages (e.g. a list of tasks running) that look like this ID, state, comment 1544, sleep, 'not doing anything' 2547, working, 'executing task ...' 3514, sleep, 'not doing anything' 7877, working, 'executing task ...' I need to count how many tasks were running / sleeping - I thought I could simply count 'sleep' occurrences, but I can't find a suitable command / function. How to do that? ... View more

When I use "export" from within the Splunk interface, the CSV contains all fields that exist in at least one row (and technical fields like punctuation etc.). When I do fetch the data using Splunk SDK (Python), the file contains just some basic fields (_raw, _time, host, index, linecount etc.) but not fields from within the messages. Is it possible to ask get all the fields, i.e. the same output as from within the Splunk interface? Perhaps some command / parameter? Also, I'd like to get the _time as unix timestamp (number), but the SDK always returns human-readable format (2012-06-11T...). ... View more

Hi, I'm using the Python SDK to export some search results to a CSV file, but the results seem to be somehow corrupted unless I specify an exact list of fields. So for example this: index=myindex field=pattern produces corrupted results but this index=myindex field=pattern | table field_a, field_b works just fine. The corruption looks a bit like a randomly scattered newline characters - the line suddenly ends (in the middle of a field), then there's a part of the original line missing and the remainder is on the next line. (or something like that, I'm not sure what is the exact corruption). The data do not contain newline characters - when exporting to JSON everything is peachy. Also there are no mixed Windows/Unix line ends (I'm on Linux). ... View more

Hi all, I'm writing a cron job (using the Python SDK) that does a search and exports the data to a CSV file (to analyze it in a different app). The result usually is a few hundreds thousands rows (~ a million or so), so I need to fetch it piecewise (by 50k). The problem is that sometimes the result suddenly disappears after fetching the first few segments. How to get rid of that? Is there an option to mark a result as 'do not remove' or something like that? ... View more