https://community.splunk.com/t5/Splunk-Search/Splunk-python-sdk-oneshot-search-How-to-get-earliest-time-and/m-p/145272#M40468 <P>Those dates are present in result as columns (or keys)</P> <P><CODE><BR /> search_results = service.jobs.oneshot(search_query, **kwargs)<BR /> reader = results.ResultsReader(search_results)<BR /> columns = reader[0].keys()<BR /> </CODE></P> Mon, 28 Sep 2020 20:11:46 GMT i2sheri 2020-09-28T20:11:46Z https://community.splunk.com/t5/Splunk-Search/Splunk-python-sdk-oneshot-search-How-to-get-earliest-time-and/m-p/145271#M40467 <P>I have a one shot search to which i am passing earliest time and latest time from time range picker. Trying to generate a report from the search results for which i need search time range as strings or python date objects.</P> <P>For Ex:<BR /> Time Range: previous month<BR /> earliest_time: -1mon@mon<BR /> latest_time: @mon' </P> <P>I need above times python date object<BR /> 30-04-2015<BR /> 31-05-2015</P> <P>also my search ends with <CODE>| chart count bla by date</CODE> =&gt; the dates are columns which i couldn't see in ResultsReader</P> Mon, 28 Sep 2020 20:11:43 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-python-sdk-oneshot-search-How-to-get-earliest-time-and/m-p/145271#M40467 i2sheri 2020-09-28T20:11:43Z https://community.splunk.com/t5/Splunk-Search/Splunk-python-sdk-oneshot-search-How-to-get-earliest-time-and/m-p/145272#M40468 <P>Those dates are present in result as columns (or keys)</P> <P><CODE><BR /> search_results = service.jobs.oneshot(search_query, **kwargs)<BR /> reader = results.ResultsReader(search_results)<BR /> columns = reader[0].keys()<BR /> </CODE></P> Mon, 28 Sep 2020 20:11:46 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-python-sdk-oneshot-search-How-to-get-earliest-time-and/m-p/145272#M40468 i2sheri 2020-09-28T20:11:46Z https://community.splunk.com/t5/Splunk-Search/Splunk-python-sdk-oneshot-search-How-to-get-earliest-time-and/m-p/145273#M40469 <P>This might no return all dates, it returns dates from search results. For Ex: If search did not return any events for 20-04-2015 then this date will not be present in reader[0].keys() </P> Tue, 11 Aug 2015 06:40:49 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-python-sdk-oneshot-search-How-to-get-earliest-time-and/m-p/145273#M40469 i2sheri 2015-08-11T06:40:49Z https://community.splunk.com/t5/Splunk-Search/Splunk-python-sdk-oneshot-search-How-to-get-earliest-time-and/m-p/145274#M40470 <P>you can use this search to get from and to dates</P> <P><CODE><BR /> search index=* | head 1<BR /> |eval e=relative_time(now(), "-1mon@mon")<BR /> |eval l=relative_time(now(), "@mon")<BR /> |eval ee=strftime(e, "%m/%d/%Y:%H:%M:%S")<BR /> |eval ll=strftime(l, "%m/%d/%Y:%H:%M:%S")<BR /> |table e l ee ll<BR /> </CODE></P> Tue, 29 Sep 2020 07:20:40 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-python-sdk-oneshot-search-How-to-get-earliest-time-and/m-p/145274#M40470 i2sheri 2020-09-29T07:20:40Z