Fields defined by a sourcetype not being shown in query results by Splunk SDK?

[yshen]

When I used the following code to perform a query:

service = client.connect(
host= 'splunk.bart.gov',
port = '8089',
username = 'userid',
password = 'secrete',
)

query = "search index=slog_ics sourcetype=occ_mgr  | table _time, ENTRY | head 3"
query_results = service.jobs.oneshot(query)
reader = res.ResultsReader(query_results)
results = []
for item in reader:
    print(item)
    results.append(item)
print("results[1]:")
print(results[1])

In the above result, I cannot see the value for the field ENTRY.

ENTRY is a field defined by the sourcetype occ_mgr in my application ics_analytics.

While in Splunk web UI, in the context of the application ics_analytics using the same query, I can see the field value of ENTRY:

index=slog_ics sourcetype=occ_mgr  | fields _time, ENTRY  | head 3

with the result:

	_time ENTRY
4/6/22 2:11:00.000 AM EOR.
4/6/22 1:48:00.000 AM (ref 0120) T203 released ATO, (762) second delay.
4/6/22 1:36:00.000 AM CORE Blanket established.

What could be the root cause of the problem?

[yshen]

With hint by https://splunk-usergroups.slack.com/team/UB5DA9L02, it turns out that as the sourcetype is only known in the context of my application ics_analytics, in the service definition with SDK, I must indicate the application context with app= argument. Here is the corrected service definition:

service = client.connect(
host= 'splunk.bart.gov',
app='ics_analysis',
port = '8089',
username = 'userid',
password = 'secrete',
)

once the sourcetype is properly declared to be known, the same code as above would be able to retrieve the field value of ENTRY.

Here is the link to the relevant documentation:
https://docs.splunk.com/DocumentationStatic/PythonSDK/1.6.16/client.html#splunklib.client.Service

This is post is a capture of Slack discussion:
https://splunk-usergroups.slack.com/archives/C04DC8JJ6/p1649351828984919?thread_ts=1649265592.685629...