Building for the Splunk Platform

earliest_time in POST call versus earliest in query itself

shikhanshu
Path Finder

I am sending a POST call to the REST endpoint search/jobs with following parameters:

    'output_mode': 'json',
    'earliest_time': '-7d',
    'latest_time': '-1d',
    'exec_mode': 'oneshot',
    'search': 'search index=ind status=FAIL | table error, sim_time'

If, instead of above, I send:

    'output_mode': 'json',
    'exec_mode': 'oneshot',
    'search': 'search index=ind earliest=-7d@d latest=-1d@d status=FAIL | table error, sim_time'

Is there a difference? In terms of performance, load on server, correctness etc.

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Aside from the fact that you're snapping to the day in one search and not the other, there should be no difference in performance.

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

Aside from the fact that you're snapping to the day in one search and not the other, there should be no difference in performance.

0 Karma

shikhanshu
Path Finder

Sorry, I missed the @d in one search! Both searches are supposed to be the same. No difference sounds great!

0 Karma

jkat54
SplunkTrust
SplunkTrust

You can always test both 10-20 times and avaerage the results. The _internal index has data related to how long the searches took.

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...