topic Re: Invalid earliest_time error using the java SDK in Getting Data In

Invalid earliest_time error using the java SDK

sharninder — Mon, 28 Sep 2020 17:58:27 GMT

I'm trying to search using a time range and the query works fine from the UI but when I use curl from the command line, I get a FATAL_ERROR invalid earliest_time error.

curl -u admin:password -k https://localhost:8089/services/search/jobs -d search="search *" -d earliest_time="10/30/2014:0:0:0" -d latest_time="10/30/2014:24:0:0"

What's wrong with the time format?

Update: I did try querying time in the format specified in the _time field and that worked but then the documentation states that the time format I used earlier should also work. Is the documentation incorrect?

Re: Invalid earliest_time error using the java SDK

sharninder — Fri, 31 Oct 2014 07:21:37 GMT

Can anyone provide an answer to this query?

Re: Invalid earliest_time error using the java SDK

sklass — Thu, 14 May 2015 19:49:06 GMT

In poking through the returned data - when it did work it looks like the format should be.

YYYY-MM-DDTHH:MM:SS

Example: 2015-05-02T07:30:00

You can also append your timezone at the end as well. Really this is way harder than it should be.

Re: Invalid earliest_time error using the java SDK

patng323 — Tue, 29 Nov 2016 01:17:04 GMT

The same problem happens in the splunk CLI tool.