Developing for Splunk Enterprise
Highlighted

Custom Python Command: Is there any way to retrieve "earliest and "latest" time range using intersplunk?

Path Finder

I'm writing a Python custom command that's generating, so it doesn't receive any events. Is there any way to retrieve "earliest" and "latest" using Intersplunk?

0 Karma
Highlighted

Re: Custom Python Command: Is there any way to retrieve "earliest and "latest" time range using intersplunk?

Esteemed Legend

You need the addinfo command, like this:

... | addinfo
0 Karma
Highlighted

Re: Custom Python Command: Is there any way to retrieve "earliest and "latest" time range using intersplunk?

SplunkTrust
SplunkTrust

Sorry to be the bearer of bad news again; but this will not work.
He's trying the build a a Python custom command that's generating, so it doesn't receive any events. therefore the command will not be able to use info_min_time nor info_max_time.
It would work if the custom command gets some events by using splunk.Intersplunk.readResults.

0 Karma