https://community.splunk.com/t5/Splunk-Dev/earliest-time-in-POST-call-versus-earliest-in-query-itself/m-p/367902#M5996 <P>Aside from the fact that you're snapping to the day in one search and not the other, there should be no difference in performance.</P> Sat, 12 Aug 2017 19:55:22 GMT jkat54 2017-08-12T19:55:22Z https://community.splunk.com/t5/Splunk-Dev/earliest-time-in-POST-call-versus-earliest-in-query-itself/m-p/367901#M5995 <P>I am sending a POST call to the REST endpoint <CODE>search/jobs</CODE> with following parameters:</P> <PRE><CODE> 'output_mode': 'json', 'earliest_time': '-7d', 'latest_time': '-1d', 'exec_mode': 'oneshot', 'search': 'search index=ind status=FAIL | table error, sim_time' </CODE></PRE> <P>If, instead of above, I send:</P> <PRE><CODE> 'output_mode': 'json', 'exec_mode': 'oneshot', 'search': 'search index=ind earliest=-7d@d latest=-1d@d status=FAIL | table error, sim_time' </CODE></PRE> <P>Is there a difference? In terms of performance, load on server, correctness etc.</P> Sat, 12 Aug 2017 18:53:10 GMT https://community.splunk.com/t5/Splunk-Dev/earliest-time-in-POST-call-versus-earliest-in-query-itself/m-p/367901#M5995 shikhanshu 2017-08-12T18:53:10Z https://community.splunk.com/t5/Splunk-Dev/earliest-time-in-POST-call-versus-earliest-in-query-itself/m-p/367902#M5996 <P>Aside from the fact that you're snapping to the day in one search and not the other, there should be no difference in performance.</P> Sat, 12 Aug 2017 19:55:22 GMT https://community.splunk.com/t5/Splunk-Dev/earliest-time-in-POST-call-versus-earliest-in-query-itself/m-p/367902#M5996 jkat54 2017-08-12T19:55:22Z https://community.splunk.com/t5/Splunk-Dev/earliest-time-in-POST-call-versus-earliest-in-query-itself/m-p/367903#M5997 <P>Sorry, I missed the @d in one search! Both searches are supposed to be the same. No difference sounds great!</P> Sat, 12 Aug 2017 19:58:01 GMT https://community.splunk.com/t5/Splunk-Dev/earliest-time-in-POST-call-versus-earliest-in-query-itself/m-p/367903#M5997 shikhanshu 2017-08-12T19:58:01Z https://community.splunk.com/t5/Splunk-Dev/earliest-time-in-POST-call-versus-earliest-in-query-itself/m-p/367904#M5998 <P>You can always test both 10-20 times and avaerage the results. The _internal index has data related to how long the searches took.</P> Sat, 12 Aug 2017 20:01:31 GMT https://community.splunk.com/t5/Splunk-Dev/earliest-time-in-POST-call-versus-earliest-in-query-itself/m-p/367904#M5998 jkat54 2017-08-12T20:01:31Z