topic Re: How to query Splunk API to only search for data for a particular time range? in Splunk Search

How to query Splunk API to only search for data for a particular time range?

rrahul963 — Tue, 20 Jan 2015 05:29:16 GMT

i am trying to query splunk api from a c# application for a particular DateTime Range using below query

search index=iis host=wssecure* earliest=\"01/15/2015:09:00:00\" latest=\"01/15/2015:09:05:00\" | head 2

but what splunk is doing is that it runs the query for the DateTime range of earliest till now and then returns the data that falls between the dateTime range of earliest to latest (as specified in the query).
Due to this if the user wants to get the data in span of 15 min for a particular day in last week, splunk takes forever to return the data as the number of events to scan through is too large.

is there a way to query splunk api and make it scan data only for particular time frame?

Re: How to query Splunk API to only search for data for a particular time range?

D2KSec1 — Sat, 21 Feb 2015 23:21:56 GMT

I am also having this issue using Python. Using the Last 15 Minutes example above, the Web UI generates a URL containing 'earliest=-15m&latest=now'.

I pass those parameters in JSON format exactly as it is displayed. Anybody have clues?

{'earliest':'-15m', 'latest':'now'} when executed returns ALL TIME, not last 15 minutes.

Re: How to query Splunk API to only search for data for a particular time range?

nikos_d — Tue, 05 May 2015 17:19:26 GMT

I am having exactly the same problem using the REST API in Python. Any help will be greatly appreciated

Re: How to query Splunk API to only search for data for a particular time range?

swbodie — Tue, 05 May 2015 19:44:44 GMT

I'm not sure if you are using the Splunk SDK for C# or not. However if you are there is a class called JobArgs that the CreateAsync method will accept which allows you to specify the earliest and latest time.

Here is an example of the creation method using the class:

Job job = await service.Jobs.CreateAsync(search, 0, ExecutionMode.Normal, new JobArgs{ EarliestTime = "@d", LatestTime = "now"}, null, DispatchState.Running).ConfigureAwait(false);