Reporting

How to define time range of a saved search using Python SDK

debugger22
Engager

I'm trying to create a saved search with following

 kwargs = {                                                
    'description': 'failed auth',
    'is_scheduled' : True,
    'cron_schedule' : '*/5 * * * *',
    'start_time' : 'rt-5s@s',
    'end_time' : 'rt+5s@s'

It gives following error:

HTTPError: HTTP 400 Bad Request -- 
 In handler 'savedsearch': Argument "start_time" is not supported by this handler.

I've also tried earliest_time and latest_time but with no luck. Please help.

Thanks in advance!

1 Solution

SIddharth5794
Explorer

Instead of using as you did, the following will work.

 kwargs = {                                                
      'description': 'failed auth',
      'is_scheduled' : True,
      'cron_schedule' : '*/5 * * * *',
      'dispatch.earliest_time' : 'rt-5s@s',
      'dispatch.latest_time' : 'rt+5s@s'
  }

View solution in original post

jaywang66
Loves-to-Learn

This works for me. I plan to do more fine tuned filter.

rr = results.ResultsReader(service.jobs.export("search host=App1 index=ftp _indextime>=1627665310 _indextime<1627665313"))
0 Karma

SIddharth5794
Explorer

Instead of using as you did, the following will work.

 kwargs = {                                                
      'description': 'failed auth',
      'is_scheduled' : True,
      'cron_schedule' : '*/5 * * * *',
      'dispatch.earliest_time' : 'rt-5s@s',
      'dispatch.latest_time' : 'rt+5s@s'
  }

StewGoin1
Explorer

I think you need to use scheduled_times and arguments to it as part of your kwargs

From the Python SDK Docs for saved searches :

class splunklib.client.SavedSearch(service, path, **kwargs)
This class represents a saved search.



scheduled_times(earliest_time='now', latest_time='+1h') Returns the times when this search is scheduled to run.

By default this method returns the times in the next hour. For different time ranges, set earliest_time and latest_time. For example, for all times in the last day use “earliest_time=-1d” and “latest_time=now”.

Parameters:  earliest_time (string) – The earliest time. latest_time (string) – The latest time. Returns:    The list of search times.
0 Karma

SIddharth5794
Explorer

Solved

kwargs = {                                                
     'description': 'failed auth',
     'is_scheduled' : True,
     'cron_schedule' : '*/5 * * * *',
     'dispatch.earliest_time' : 'rt-5s@s',
     'dispatch.latest_time' : 'rt+5s@s'
 }
0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...