Sumologic search job returning incorrect number of messages

[ssapa]

We are using Sumologic SDK for doing a search in sumologic.

So first we are creating a search job, then checking the status of the job.

1. sumoClient.createSearchJob
2. sumoClient.getSearchJobStatus(searchJobId)

Here is the search job status object looks like :
'DONE GATHERING RESULTS', histogram buckets: [startTimestamp: 'Thu Nov 09 00:50:00 EST 2023', length '300000', count: '24630', startTimestamp: 'Thu Nov 09 00:45:00 EST 2023', length '300000', count: '32273', startTimestamp: 'Thu Nov 09 00:40:00 EST 2023', length '300000', count: '30581', startTimestamp: 'Thu Nov 09 00:35:00 EST 2023', length '300000', count: '31248', startTimestamp: 'Thu Nov 09 00:30:00 EST 2023', length '300000', count: '34215', startTimestamp: 'Thu Nov 09 00:25:00 EST 2023', length '300000', count: '28418', startTimestamp: 'Thu Nov 09 00:20:00 EST 2023', length '300000', count: '27152', startTimestamp: 'Thu Nov 09 00:15:00 EST 2023', length '300000', count: '28202', startTimestamp: 'Thu Nov 09 00:10:00 EST 2023', length '300000', count: '22615', startTimestamp: 'Thu Nov 09 00:05:00 EST 2023', length '300000', count: '28433', startTimestamp: 'Thu Nov 09 00:00:00 EST 2023', length '300000', count: '27646', startTimestamp: 'Wed Nov 08 23:55:00 EST 2023', length '300000', count: '26589', startTimestamp: 'Wed Nov 08 23:50:00 EST 2023', length '300000', count: '29374', startTimestamp: 'Wed Nov 08 23:45:00 EST 2023', length '300000', count: '29885', startTimestamp: 'Wed Nov 08 23:40:00 EST 2023', length '300000', count: '28580', startTimestamp: 'Wed Nov 08 23:35:00 EST 2023', length '300000', count: '29932', startTimestamp: 'Wed Nov 08 23:30:00 EST 2023', length '300000', count: '32426', startTimestamp: 'Wed Nov 08 23:25:00 EST 2023', length '300000', count: '28755', startTimestamp: 'Wed Nov 08 23:20:00 EST 2023', length '300000', count: '30891', startTimestamp: 'Wed Nov 08 23:15:00 EST 2023', length '300000', count: '28168', startTimestamp: 'Wed Nov 08 23:10:00 EST 2023', length '300000', count: '27221', startTimestamp: 'Wed Nov 08 23:05:00 EST 2023', length '300000', count: '30331', startTimestamp: 'Wed Nov 08 23:00:00 EST 2023', length '300000', count: '34658', startTimestamp: 'Wed Nov 08 22:55:00 EST 2023', length '300000', count: '35714', startTimestamp: 'Wed Nov 08 22:50:00 EST 2023', length '300000', count: '39262', startTimestamp: 'Wed Nov 08 22:45:00 EST 2023', length '300000', count: '41335', startTimestamp: 'Wed Nov 08 22:40:00 EST 2023', length '300000', count: '42725', startTimestamp: 'Wed Nov 08 22:35:00 EST 2023', length '300000', count: '40337'], message count: '200000', record count: '2027', pending warnings: [], pending errors: []

We are waiting till the status of the job states as "DONE GATHERING RESULTS" and reading the messages count.
So here, the messageCount always showing as 200000 when there are more than 200000 messages.

So, can someone help me here, What am I missing, or is there any limitation on number of messages in sumo logic api?

[jeremybusk]

https://help.sumologic.com/docs/api/search-job/

100k limit here but api seems to allow 200k but please validate using both in test to make sure you don't actually lose messages in test. 100k limit would be after option, you have to reduce query time window to do that.