topic Re: Splunk python sdk - How to set custom time duration to run saved searches in Splunk Dev

Splunk python sdk - How to set custom time duration to run saved searches

pinpoint — Thu, 15 Nov 2012 11:30:03 GMT

Hi All - I am new to splunk python SDK and am stuck with running saved searches for custom durations. So far, using the splunk documentation and examples I am able to execute saved searches using the python SDK, however I couldn't find a way to set the earliest/latest time parameters. Whatever the value I set the default duration for the saved search is used. Here is a snippet of what I have so far :

args = {"earliest_time":"-d60"}
job = searchName.dispatch(**args)

Tried this as well: args = {"earliestTime":"-d60"}

Is there a way to set custom duration for saved searches using python sdk?

Thanks.

Re: Splunk python sdk - How to set custom time duration to run saved searches

pinpoint — Thu, 15 Nov 2012 12:01:30 GMT

Sorry guys, I should have done some more research before posting the question. I did some poking around and got it to work. Here is what I set for duration:

args = {"dispatch.earliest_time":"-100d"}

Re: Splunk python sdk - How to set custom time duration to run saved searches

apruneda_splunk — Thu, 15 Nov 2012 19:40:17 GMT

Look at this example, specifically the format for earliest and latest times:
http://dev.splunk.com/view/SP-CAAAEE5#oneshotjob

This example shows how to set a time range in Python.

Re: Splunk python sdk - How to set custom time duration to run saved searches

pinpoint — Mon, 19 Nov 2012 12:59:34 GMT

Thanks for the link. The table 'Saved search parameters' had all the supported parameters.