I'm writing a Python custom command that's generating, so it doesn't receive any events. Is there any way to retrieve "earliest" and "latest" using Intersplunk?
You need the addinfo
command, like this:
... | addinfo
Sorry to be the bearer of bad news again; but this will not work.
He's trying the build a a Python custom command that's generating, so it doesn't receive any events.
therefore the command will not be able to use info_min_time
nor info_max_time
.
It would work if the custom command gets some events by using splunk.Intersplunk.readResults
.