topic Re: What timeframe do REST API searches use? in Splunk Search

What timeframe do REST API searches use?

random_event — Tue, 18 Apr 2023 22:17:48 GMT

I need to count the number of times an alert has triggered in a specific time window (say, last 24 hours). I am trying to do that via | rest but noticed the counts remain constant despite changing the search time interval (60m, yesterday, last 7d, 15m, etc.).

What "time" does the | rest search or return results for? I tried reading the docs on rest and and the user manual for REST API but nothing quite explains it.

Current SPL

| rest /services/alerts/fired_alerts splunk_server=local | search author="me@me.com" | table eai:acl.app eai:acl.owner id title triggered_alert_count | rename eai:acl.* as *, app as App, owner as Owner, id as Endpoint, title as Title, triggered_alert_count as "Count of Triggered Alerts"

Re: What timeframe do REST API searches use?

rohit1793 — Wed, 19 Apr 2023 02:30:39 GMT

Hello @random_event ,

It pulls whatever you have at that endpoint for all time.for example if you want to know all the KO belongs to x person you can filter it and see all the enabled and disabled KO’s belongs to the x.

Re: What timeframe do REST API searches use?

random_event — Wed, 19 Apr 2023 14:18:31 GMT

Okay, so REST will query all available data as you said for "all time". How is the time determined? Is it based on the retention of internal indexes (mine is set to 60d)?

Re: What timeframe do REST API searches use?

VatsalJagani — Wed, 19 Apr 2023 16:26:28 GMT

@random_event - Most of the | rest command gives constant output regardless of time-range selected.

So if you want something specific, then you have to filter with | where condition. So look at the results there must be some field in it with time in it, on which you can apply the where condition to filter as you like.

I hope this helps, upvote if it does!!!