topic Re: REST API - error "Invalid earliest_time." in Getting Data In

REST API - error "Invalid earliest_time."

jetzt82 — Thu, 11 Dec 2014 04:52:10 GMT

Use Splunk SDK JAVA, I'd use the REST API.
If the settings as follows causes an error.

code:

Args queryArgs = new Args();
queryArgs.put("earliest_time",  "8/21/2014:00:00:00");
queryArgs.put("latest_time",    "8/31/2014:23:59:59");

error:

[Fatal Error] :1:1: Unexpected end of file.
Exception in thread "main" com.splunk.HttpException: HTTP 400 -- <?xml version="1.0" encoding="UTF-8"?>
<response>
  <messages>
    <msg type="FATAL">Invalid earliest_time.</msg>
  </messages>
</response>

at com.splunk.HttpException.create(HttpException.java:84)
at com.splunk.HttpService.send(HttpService.java:386)
at com.splunk.Service.send(Service.java:1268)
at com.splunk.HttpService.post(HttpService.java:243)
at com.splunk.JobCollection.create(JobCollection.java:81)
at Test01_02.Test01_02_01.main(Test01_02_01.java:59)

Are there any workaround for this?

Re: REST API - error "Invalid earliest_time."

richgalloway — Thu, 11 Dec 2014 05:45:06 GMT

The format of the time strings don't look right. Have you tried "8/31/2014T00:00:00"?

Re: REST API - error "Invalid earliest_time."

jetzt82 — Mon, 28 Sep 2020 18:21:27 GMT

queryArgs.put("earliest_time", "8/21/2014T00:00:00");
queryArgs.put("latest_time", "8/31/2014T23:59:59");

The same error occurs.

Re: REST API - error "Invalid earliest_time."

sklass — Thu, 14 May 2015 19:49:36 GMT

In poking through the returned data - when it did work it looks like the format should be.

YYYY-MM-DDTHH:MM:SS

Example: 2015-05-02T07:30:00

You can also append your timezone at the end as well. Really this is way harder than it should be.

Re: REST API - error "Invalid earliest_time."

swaprks — Fri, 19 Apr 2024 16:39:13 GMT

Did you manage to get a solution for this? For me as well this fails. But the relative thing works. Like -1d and so but this does not

MM/dd/yyyy':'HH:mm:ss