Getting Data In

Time Modifier "latest=@mon+20d" in REST API

ankur_kumar377
New Member

Time modifier is not working with splunk rest API. Below is the query.

curl -k -u 'xxxxxxxxx:xxxxxxxxx' https://api-splunk.com:8089/services/search/jobs/export -d search="search earliest=@mon-10d latest=@mon+20d index=usage_summary report=LicenseUsage | search idx= | dedup _time,idx | timechart span=1d sum(MBytes) as LicenseUsagePerDay| stats avg(LicenseUsagePerDay) as AveLicenseUsagePerDay | table AveLicenseUsagePerDay" -d output_mode=csv

it's not displaying any data but when we replace latest=@mon+20d to latest=now then it's working fine.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!