topic Rest commands with search time reference in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Rest-commands-with-search-time-reference/m-p/295021#M56037 <P>Hi Splunkers,</P> <P>I need to search alerts triggered for my app in the given time range. The time range is selected from time range picker. Do anyone have any inputs?</P> <P>I am struggling with:<BR /> | rest /servicesNS/-/-/saved/searches search="eai:acl.app=test AND disabled=0" | table title eai:acl.app eai:acl.owner disabled is_scheduled cron_schedule </P> <P>but this gives consistent result irrespective of time selected.</P> <P>please help with some pointers</P> <P>Best,</P> Tue, 29 Sep 2020 18:43:19 GMT splunkdivya 2020-09-29T18:43:19Z Rest commands with search time reference https://community.splunk.com/t5/Getting-Data-In/Rest-commands-with-search-time-reference/m-p/295021#M56037 <P>Hi Splunkers,</P> <P>I need to search alerts triggered for my app in the given time range. The time range is selected from time range picker. Do anyone have any inputs?</P> <P>I am struggling with:<BR /> | rest /servicesNS/-/-/saved/searches search="eai:acl.app=test AND disabled=0" | table title eai:acl.app eai:acl.owner disabled is_scheduled cron_schedule </P> <P>but this gives consistent result irrespective of time selected.</P> <P>please help with some pointers</P> <P>Best,</P> Tue, 29 Sep 2020 18:43:19 GMT https://community.splunk.com/t5/Getting-Data-In/Rest-commands-with-search-time-reference/m-p/295021#M56037 splunkdivya 2020-09-29T18:43:19Z Re: Rest commands with search time reference https://community.splunk.com/t5/Getting-Data-In/Rest-commands-with-search-time-reference/m-p/295022#M56038 <P>Specifying time ranges with the <CODE>rest</CODE> command is a little wonky, but it's totally doable. Here's an example, which would search over yesterday:</P> <PRE><CODE>| rest /servicesNS/-/-/saved/searches search="eai:acl.app=test AND disabled=0" earliest_time=`time_modifier(-1d@d)` latest_time=`time_modifier(@d)` | table title eai:acl.app eai:acl.owner disabled is_scheduled cron_schedule </CODE></PRE> <P>The time modifiers you can use are the ones documented here: <A href="http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/SearchTimeModifiers">http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/SearchTimeModifiers</A></P> Wed, 28 Mar 2018 13:29:27 GMT https://community.splunk.com/t5/Getting-Data-In/Rest-commands-with-search-time-reference/m-p/295022#M56038 elliotproebstel 2018-03-28T13:29:27Z