https://community.splunk.com/t5/Getting-Data-In/What-is-the-correct-earliest-time-format-for-searches-when/m-p/354830#M64904 <P>earliest_time = YYYY-MM-DDTHH:MM:SS</P> <P>Example: earliest_time = 2017-03-14T10:0:0</P> Tue, 14 Mar 2017 16:42:04 GMT the_wolverine 2017-03-14T16:42:04Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-correct-earliest-time-format-for-searches-when/m-p/354829#M64903 <P>I'm using Python SDK (or some other client) to query Splunk and its not accepting my date format. What is the correct format to specify for earliest_time?</P> Tue, 14 Mar 2017 16:39:16 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-correct-earliest-time-format-for-searches-when/m-p/354829#M64903 the_wolverine 2017-03-14T16:39:16Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-correct-earliest-time-format-for-searches-when/m-p/354830#M64904 <P>earliest_time = YYYY-MM-DDTHH:MM:SS</P> <P>Example: earliest_time = 2017-03-14T10:0:0</P> Tue, 14 Mar 2017 16:42:04 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-correct-earliest-time-format-for-searches-when/m-p/354830#M64904 the_wolverine 2017-03-14T16:42:04Z https://community.splunk.com/t5/Getting-Data-In/What-is-the-correct-earliest-time-format-for-searches-when/m-p/354831#M64905 <P>here is a doc about it:</P> <P><A href="http://dev.splunk.com/view/SP-CAAAEE5#oneshotjo">http://dev.splunk.com/view/SP-CAAAEE5#oneshotjo</A></P> <PRE><CODE>"earliest_time": "2017-03-14T12:00:00.000-07:00" </CODE></PRE> Tue, 14 Mar 2017 17:25:19 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-the-correct-earliest-time-format-for-searches-when/m-p/354831#M64905 cmerriman 2017-03-14T17:25:19Z