topic Re: How do I pass a specific time to a search run with the Python SDK? in Splunk Dev

How do I pass a specific time to a search run with the Python SDK?

anshanno — Sat, 21 Jan 2017 21:17:12 GMT

I have read the time modifier documentation here: https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/SearchReference/SearchTimeModifiers#_time_and__indextime_fields

kwargs_export = {"earliest_time": "10/5/2016:20:00:00",
                 "latest_time": "now",
                 "search_mode": "normal"}

This is what I am passing for my search. I copy and pasted the date format exactly as it is in the documentation and I am getting the below error.

splunklib.binding.HTTPError: HTTP 400 Bad Request -- Invalid earliest_time.

Am I missing something? Any help is greatly appreciated! Thanks!

EDIT:

For those in the future looking for the answer, example below will work as expected.

kwargs_export = {"earliest_time": "2017-01-24T07:20:38.000-05:00",
                 "latest_time": "now",
                 "search_mode": "normal"}

Re: How do I pass a specific time to a search run with the Python SDK?

jkat54 — Tue, 29 Sep 2020 12:29:24 GMT

To my knowledge there isn't an earliest_time or latest_time. Instead I believe you should be using earliest and latest without _time appended.

Re: How do I pass a specific time to a search run with the Python SDK?

anshanno — Mon, 23 Jan 2017 13:15:30 GMT

Ah. Fantastic, thanks. That was the error preventing it from running...Any idea why it doesn't stop at the specified latest value, "now"?.

Re: How do I pass a specific time to a search run with the Python SDK?

jkat54 — Mon, 23 Jan 2017 15:12:59 GMT

When I want "now" in splunk i typically use "now()". Have you tried that?

Re: How do I pass a specific time to a search run with the Python SDK?

anshanno — Mon, 23 Jan 2017 16:27:29 GMT

Whoops, I meant specified earliest value. It doesn't stop returning log files when the search reaches the specified earliest value. That was my mistake.

Re: How do I pass a specific time to a search run with the Python SDK?

jkat54 — Mon, 23 Jan 2017 21:40:29 GMT

Does earliest=now() work?

Re: How do I pass a specific time to a search run with the Python SDK?

anshanno — Tue, 24 Jan 2017 13:53:08 GMT

Apparently with the python SDK you need to specify the time in UTC format. That was my issue. Thanks for the help!