Rest commands with search time reference

[splunkdivya]

Hi Splunkers,

I need to search alerts triggered for my app in the given time range. The time range is selected from time range picker. Do anyone have any inputs?

I am struggling with:
| rest /servicesNS/-/-/saved/searches search="eai:acl.app=test AND disabled=0" | table title eai:acl.app eai:acl.owner disabled is_scheduled cron_schedule

but this gives consistent result irrespective of time selected.

please help with some pointers

Best,

[elliotproebstel]

Specifying time ranges with the rest command is a little wonky, but it's totally doable. Here's an example, which would search over yesterday:

| rest /servicesNS/-/-/saved/searches search="eai:acl.app=test AND disabled=0" earliest_time=`time_modifier(-1d@d)` latest_time=`time_modifier(@d)` 
| table title eai:acl.app eai:acl.owner disabled is_scheduled cron_schedule

The time modifiers you can use are the ones documented here: http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/SearchTimeModifiers