Getting Data In
Highlighted

Time Modifier "latest=@mon+20d" in REST API

New Member

Time modifier is not working with splunk rest API. Below is the query.

curl -k -u 'xxxxxxxxx:xxxxxxxxx' https://api-splunk.com:8089/services/search/jobs/export -d search="search earliest=@mon-10d latest=@mon+20d index=usagesummary report=LicenseUsage | search idx= | dedup _time,idx | timechart span=1d sum(MBytes) as LicenseUsagePerDay| stats avg(LicenseUsagePerDay) as AveLicenseUsagePerDay | table AveLicenseUsagePerDay" -d outputmode=csv

it's not displaying any data but when we replace latest=@mon+20d to latest=now then it's working fine.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.