https://community.splunk.com/t5/Splunk-Search/Time-range-in-rest-query-Unable-to-get-it-down-to-last-hour/m-p/618905#M215100 <P>Hi&nbsp;<SPAN>Ra1n,</SPAN></P><P>the | rest command gives you the state of an endpoint - in this case savedsearches. Dit does not - what you might expect - gives you a history. That's why timebases searches are not working by default.&nbsp;</P><P>if you want an audit on your correlation searches, i would suggest implement a cicd workflow and have the app and/or savedsearches.conf file version controled... particularly if dealing in security environments.&nbsp;</P><P>best regards,</P><P>Andreas</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Mon, 31 Oct 2022 11:56:45 GMT schose 2022-10-31T11:56:45Z https://community.splunk.com/t5/Splunk-Search/Time-range-in-rest-query-Unable-to-get-it-down-to-last-hour/m-p/618903#M215098 <P>Hi,&nbsp;</P> <P>ive got the below query that im using to try and see when correlation searches have been edited:</P> <LI-CODE lang="markup">| rest splunk_server=local count=0 /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | where disabled=0 | eval actions=split(actions, ",") | rename "eai:acl.owner" as "Created By" | rename author as "Updated By" | rename updated as "Update time" | fields title, search, description, "Update time", "Updated By", "Created By"</LI-CODE> <P>The issue that I'm having here is that no matter what i try, I am unable to narrow this down to the last hour for example and it always returns the last couple of months.</P> <P>Any help on this would be great!</P> Mon, 31 Oct 2022 14:08:47 GMT https://community.splunk.com/t5/Splunk-Search/Time-range-in-rest-query-Unable-to-get-it-down-to-last-hour/m-p/618903#M215098 Ra1n 2022-10-31T14:08:47Z https://community.splunk.com/t5/Splunk-Search/Time-range-in-rest-query-Unable-to-get-it-down-to-last-hour/m-p/618905#M215100 <P>Hi&nbsp;<SPAN>Ra1n,</SPAN></P><P>the | rest command gives you the state of an endpoint - in this case savedsearches. Dit does not - what you might expect - gives you a history. That's why timebases searches are not working by default.&nbsp;</P><P>if you want an audit on your correlation searches, i would suggest implement a cicd workflow and have the app and/or savedsearches.conf file version controled... particularly if dealing in security environments.&nbsp;</P><P>best regards,</P><P>Andreas</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Mon, 31 Oct 2022 11:56:45 GMT https://community.splunk.com/t5/Splunk-Search/Time-range-in-rest-query-Unable-to-get-it-down-to-last-hour/m-p/618905#M215100 schose 2022-10-31T11:56:45Z