I am looking to export the results of a Splunk search that contains transforming commands. When I run the same search in the web GUI the live results "hang" on 50,000 stats, but once the search is complete it shows more than 300,000. (screenshots provided below) Using the Splunk API, I want to export all results in a .json format, and I only want to view the final results; I do not want to view the results as they are streamed In essence I want to avoid the API returning any row where: "preview":true What am I missing? While performing search Finished results Using python 3.9's requests, my script contains the following: headers={'Authorization': 'Splunk %s' % sessionKey}
parameters={'exec_mode': "oneshot", 'output_mode':output_type, 'adhoc_search_level':'fast', 'count':0}
with post(url=baseurl + '/services/search/jobs/export',params=parameters, data=({'search': search_query}), timeout=60, headers=headers, verify=False, stream=True) as response:
... View more