topic Re: How to pass a time range using API in Splunk Dev

How to pass a time range using API

moe786 — Tue, 05 Mar 2019 14:33:38 GMT

So I am using the Splunk SDK with Python 3.7.x (splunklib) and am trying to figure out how to ask for data in a certain time range. Right now I'm simply passing it a query, but when I try to pass time, it just ignores the range and sends me all the data for the last few months of data.

Using this to run the job searches:

rr = results.ResultsReader(service.jobs.export(query))

How do I get data from a certain time range using the SDK?

Re: How to pass a time range using API

sdchakraborty — Tue, 05 Mar 2019 18:52:42 GMT

Hi,

In your query itself you can pass earliest and latest time. It will filter accordingly. Something like,

rr = results.ResultsReader(service.jobs.export("search index=_internal earliest=-1h | head 5"))

Sid

Re: How to pass a time range using API

moe786 — Tue, 05 Mar 2019 18:57:08 GMT

Do I need to worry about stuff like the time format or having it in %H-%M-%S format or something?

Re: How to pass a time range using API

sdchakraborty — Tue, 05 Mar 2019 19:09:10 GMT

I think you need to convert them to epoch format before you pass them to earliest or latest.

Re: How to pass a time range using API

moe786 — Tue, 05 Mar 2019 19:16:50 GMT

So it would be earliest=-epochformedtime ?

Re: How to pass a time range using API

sdchakraborty — Tue, 05 Mar 2019 19:18:34 GMT

when you are giving epoch for earliest and latest no need to give negative number.

Re: How to pass a time range using API

moe786 — Tue, 05 Mar 2019 19:38:16 GMT

okay tyvm

Re: How to pass a time range using API

sdchakraborty — Wed, 06 Mar 2019 05:31:28 GMT

Hi,

If you fine with the answer please accept it as answer. I have converted my comment as answer.

Sid

Re: How to pass a time range using API

jaywang66 — Fri, 30 Jul 2021 20:47:16 GMT

This works for me. I plan to do more fine tune on the search filter.

rr = results.ResultsReader(service.jobs.export("search host=App1 index=ftp _indextime>=1627665310 _indextime<1627665313"))