Getting Data In

REST API - Search - Always searches for "All Time" and ignores earliest

kvmadan
Explorer

I'm calling REST to submit a job search and always it considers All Time and ignores the earliest..

Is there anything wrong in the search query i am posting?

search=search "index=center host=center* AND sourcetype=abf:afz.log "DebugLogSubmission" "time" earliest=-24h@h | rex time=(?[\d]+) |table _time mytime | head 100"

Tags (3)
0 Karma

jkat54
SplunkTrust
SplunkTrust

Straight from the docs....

You need to send the earliestTime param:

https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTREF/RESTsearch#search.2Fjobs

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...