https://community.splunk.com/t5/Getting-Data-In/REST-API-Search-Always-searches-for-quot-All-Time-quot-and/m-p/462796#M79866 <P>I'm calling REST to submit a job search and always it considers <STRONG>All Time</STRONG> and ignores the <STRONG>earliest</STRONG>.. </P> <P>Is there anything wrong in the search query i am posting? </P> <P>search=search "index=center host=center* AND sourcetype=abf:afz.log "DebugLogSubmission" "time" <STRONG>earliest=-24h@h</STRONG> | rex time=(?[\d]+) |table _time mytime | head 100"</P> Thu, 06 Feb 2020 06:11:37 GMT kvmadan 2020-02-06T06:11:37Z https://community.splunk.com/t5/Getting-Data-In/REST-API-Search-Always-searches-for-quot-All-Time-quot-and/m-p/462796#M79866 <P>I'm calling REST to submit a job search and always it considers <STRONG>All Time</STRONG> and ignores the <STRONG>earliest</STRONG>.. </P> <P>Is there anything wrong in the search query i am posting? </P> <P>search=search "index=center host=center* AND sourcetype=abf:afz.log "DebugLogSubmission" "time" <STRONG>earliest=-24h@h</STRONG> | rex time=(?[\d]+) |table _time mytime | head 100"</P> Thu, 06 Feb 2020 06:11:37 GMT https://community.splunk.com/t5/Getting-Data-In/REST-API-Search-Always-searches-for-quot-All-Time-quot-and/m-p/462796#M79866 kvmadan 2020-02-06T06:11:37Z https://community.splunk.com/t5/Getting-Data-In/REST-API-Search-Always-searches-for-quot-All-Time-quot-and/m-p/462797#M79867 <P>Straight from the docs....</P> <P>You need to send the earliestTime param:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTREF/RESTsearch#search.2Fjobs">https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTREF/RESTsearch#search.2Fjobs</A></P> Thu, 06 Feb 2020 07:53:48 GMT https://community.splunk.com/t5/Getting-Data-In/REST-API-Search-Always-searches-for-quot-All-Time-quot-and/m-p/462797#M79867 jkat54 2020-02-06T07:53:48Z