https://community.splunk.com/t5/Getting-Data-In/Time-Modifier-quot-latest-mon-20d-quot-in-REST-API/m-p/500035#M85218 <P>Time modifier is not working with splunk rest API. Below is the query.</P> <P>curl -k -u 'xxxxxxxxx:xxxxxxxxx' <A href="https://api-splunk.com:8089/services/search/jobs/export" target="_blank">https://api-splunk.com:8089/services/search/jobs/export</A> -d search="search earliest=@mon-10d latest=@mon+20d index=usage_summary report=LicenseUsage | search idx= | dedup _time,idx | timechart span=1d sum(MBytes) as LicenseUsagePerDay| stats avg(LicenseUsagePerDay) as AveLicenseUsagePerDay | table AveLicenseUsagePerDay" -d output_mode=csv</P> <P>it's not displaying any data but when we replace latest=@mon+20d to latest=now then it's working fine.</P> Wed, 30 Sep 2020 04:42:12 GMT ankur_kumar377 2020-09-30T04:42:12Z https://community.splunk.com/t5/Getting-Data-In/Time-Modifier-quot-latest-mon-20d-quot-in-REST-API/m-p/500035#M85218 <P>Time modifier is not working with splunk rest API. Below is the query.</P> <P>curl -k -u 'xxxxxxxxx:xxxxxxxxx' <A href="https://api-splunk.com:8089/services/search/jobs/export" target="_blank">https://api-splunk.com:8089/services/search/jobs/export</A> -d search="search earliest=@mon-10d latest=@mon+20d index=usage_summary report=LicenseUsage | search idx= | dedup _time,idx | timechart span=1d sum(MBytes) as LicenseUsagePerDay| stats avg(LicenseUsagePerDay) as AveLicenseUsagePerDay | table AveLicenseUsagePerDay" -d output_mode=csv</P> <P>it's not displaying any data but when we replace latest=@mon+20d to latest=now then it's working fine.</P> Wed, 30 Sep 2020 04:42:12 GMT https://community.splunk.com/t5/Getting-Data-In/Time-Modifier-quot-latest-mon-20d-quot-in-REST-API/m-p/500035#M85218 ankur_kumar377 2020-09-30T04:42:12Z