topic timerange in python custom command in Splunk Dev

timerange in python custom command

dominiquevocat — Sat, 14 Mar 2015 15:40:00 GMT

How can i get the earliest and latest time as epoch in a custom command written in python? Either its not possible, i am dense or the docu is not very detailed.

update:
What i need to set it two datetime fields in the format 2015-03-16-17-13-00 and i would like to get the timerange from the timerange picker. Alternative can be a calculated value and provide a form for easy usage. I use these parameters when calling a webservice.

Re: timerange in python custom command

martin_mueller — Sun, 15 Mar 2015 23:38:36 GMT

I fear this may not be possible, as I detailed in this answer: http://answers.splunk.com/answers/116430/earliest-and-latest-information-in-custom-python-search-command.html
Until someone proves me wrong I'd go with the addinfo workaround.

Re: timerange in python custom command

dominiquevocat — Mon, 16 Mar 2015 16:42:48 GMT

yes, i did see that question and it is rather the same i suppose. I did include
results, dummyresults, settings = splunk.Intersplunk.getOrganizedResults()
and i search
|addinfo |mycustomcommand few=params
and i get this in settings
{ 'allowStream': '1'
'sid': '1426523758.18492'
'splunkVersion': '6.2.0'

'preview': '0'
'realtime': '0'
'truncated': '0'
'search': '|addinfo |mycustomcommand few=params"'
'keywords': '""'
}

so i fail to see how this should work? Did no one ever write custom command where you did not have to pass the timerange in preminced parameters?

Re: timerange in python custom command

martin_mueller — Mon, 16 Mar 2015 20:54:06 GMT

Your search fails because you're trying to add the fields returned by addinfo to zero results, giving you the fields zero times. Run this instead:

| stats count | addinfo | mycustomcommand few=params

The stats count will turn zero results into one result with count=0, allowing addinfo to do its thing. Look for info_min_time and info_max_time fields.

As for your other question, I don't know of any. Stuff like timechart uses the time range, but is built-in so it doesn't need to rely on this interface.

Re: timerange in python custom command

dominiquevocat — Mon, 28 Sep 2020 19:10:37 GMT

Thanks for the heads-up. I did include the " |stats count ", i had previsouly added some fake commands so i have some results 🙂 but changed to do it as you indicated. However i do not have more in the setting tuple.

Let me reiterate. I do the search as you said plus in the python i do
results, dummyresults, settings = splunk.Intersplunk.getOrganizedResults()
print settings
so i get it in the results in splunk, i also log it out but that is beside the point.
I still only get
splunkVersion,keywords,allowStream,preview,sid,truncated,realtime,search in settings

Whereas if i do
myvariable = settings.get('info_min_time','these are not the droids you are looking for')
print myvariable
returns
these are not the droids you are looking for
so i think is not working very very well?

any hints?

Re: timerange in python custom command

martin_mueller — Tue, 17 Mar 2015 18:24:41 GMT

The fields won't end up in the settings tuple, they will end up in the results tuple.

Re: timerange in python custom command

dominiquevocat — Thu, 19 Mar 2015 14:06:25 GMT

ok, i see what you mean. The object results is of type list where the value is visible when i print it so i need to transform it. I hope i find a nice example :-). Can splunk please seriously consider passing the timerange pretty please? 🙂

Re: timerange in python custom command

martin_mueller — Thu, 19 Mar 2015 22:23:45 GMT

You can always submit a feature request through the support portal at https://login.splunk.com/page/sso_redirect?type=portal

Re: timerange in python custom command

Dev999 — Mon, 15 Aug 2016 17:10:55 GMT

I know this is an old thread. But here is my solution:

create an regular time picker input field, and use earliest and latest as command parameter. The python can get the them as normal parameters.

  <input type="time" token="my_time" searchWhenChanged="false">
          <label>Time Range</label>
          <default>
            <earliest>-7d@h</earliest>
            <latest>now</latest>
          </default>

....

 <search>
          <query>|mycommand myparameters  earliest=$my_time.earliest$ latest=$my_time.latest$
          </query>
        </search>

It does not seem to have a built-in validator for time range. this brings a new question: is there a way to get the parsed time values? Hate to redo it as Splunk has already done it.

Re: timerange in python custom command

sloshburch — Mon, 15 Aug 2016 21:18:21 GMT

I'm surprised the $my_time$ calls don't work. You're on a recent release of Splunk, right?

The usual behavior is to refer to those tokens within similar <earliest> and <latest> tags as part of the search definition. You should be able to set that up in the UI without reverting to the source editor.

If that makes no sense, I can be more specific.

Re: timerange in python custom command

dominiquevocat — Tue, 16 Aug 2016 08:57:06 GMT

looks like a fairly nice workaround, i will try it 🙂 but would really like to have it directly in one of the tuples

Re: timerange in python custom command

sloshburch — Tue, 16 Aug 2016 13:17:11 GMT

What exactly do you mean by "directly in one of the tuples"? I may have misunderstood originally.

Re: timerange in python custom command

Dev999 — Tue, 16 Aug 2016 13:41:58 GMT

this is for custom command, not regular Splunk search. the time range is used as parameters for a custom command that is consumed by python code on the Splunk server, not within dashboard page.

Re: timerange in python custom command

dominiquevocat — Wed, 17 Aug 2016 07:12:40 GMT

Hi SloshBurch, my question was regarding writing a custom command and take the search earliest and searchlatest for passing the timerange to filter a request to a api.

Re: timerange in python custom command

sloshburch — Wed, 17 Aug 2016 12:20:15 GMT

Ok, so you were not asking in response to what I posted. Just wanted to make sure.

Re: timerange in python custom command

Dev999 — Wed, 17 Aug 2016 14:51:25 GMT

If you are using GeneratingCommand in python sdk, here is the answer, tested both at Search command and in a dashboard:

def generate(self):
   ....
   search_results = self.search_results_info
   logger.debug('search time: %s %s' % (str(search_results.search_et), str(search_results.search_lt)) )
   ....

Result:
search time: 1470837600.0 1471443921.0

Re: timerange in python custom command

Dev999 — Wed, 17 Aug 2016 14:52:33 GMT

please ignore this answer. See the new one above.

Re: timerange in python custom command

dominiquevocat — Fri, 19 Aug 2016 08:25:05 GMT

Works nicely. I just might polish this half-assed PRTG custom command finally 🙂

Re: timerange in python custom command

jason96 — Tue, 01 Jan 2019 10:51:01 GMT

Thank you for your good answer!!!!

Re: timerange in python custom command

NathanielHunter — Wed, 30 Jan 2019 20:26:02 GMT

This works well for me until I selected the all time option, then an error telling me it can't read the property. Any ideas how to work around this issue?