Getting Data In
Highlighted

Time Modifier "latest=@mon+20d" in REST API

New Member

Time modifier is not working with splunk rest API. Below is the query.

curl -k -u 'xxxxxxxxx:xxxxxxxxx' https://api-splunk.com:8089/services/search/jobs/export -d search="search earliest=@mon-10d latest=@mon+20d index=usagesummary report=LicenseUsage | search idx= | dedup _time,idx | timechart span=1d sum(MBytes) as LicenseUsagePerDay| stats avg(LicenseUsagePerDay) as AveLicenseUsagePerDay | table AveLicenseUsagePerDay" -d outputmode=csv

it's not displaying any data but when we replace latest=@mon+20d to latest=now then it's working fine.

0 Karma