Splunk Dev

How do I pass a specific time to a search run with the Python SDK?

anshanno
Path Finder

I have read the time modifier documentation here: https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/SearchReference/SearchTimeModifiers#_time...

kwargs_export = {"earliest_time": "10/5/2016:20:00:00",
                 "latest_time": "now",
                 "search_mode": "normal"}

This is what I am passing for my search. I copy and pasted the date format exactly as it is in the documentation and I am getting the below error.

splunklib.binding.HTTPError: HTTP 400 Bad Request -- Invalid earliest_time.

Am I missing something? Any help is greatly appreciated! Thanks!

EDIT:

For those in the future looking for the answer, example below will work as expected.

kwargs_export = {"earliest_time": "2017-01-24T07:20:38.000-05:00",
                 "latest_time": "now",
                 "search_mode": "normal"}
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

To my knowledge there isn't an earliest_time or latest_time. Instead I believe you should be using earliest and latest without _time appended.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

To my knowledge there isn't an earliest_time or latest_time. Instead I believe you should be using earliest and latest without _time appended.

jkat54
SplunkTrust
SplunkTrust

Does earliest=now() work?

0 Karma

anshanno
Path Finder

Apparently with the python SDK you need to specify the time in UTC format. That was my issue. Thanks for the help!

0 Karma

anshanno
Path Finder

Ah. Fantastic, thanks. That was the error preventing it from running...Any idea why it doesn't stop at the specified latest value, "now"?.

0 Karma

jkat54
SplunkTrust
SplunkTrust

When I want "now" in splunk i typically use "now()". Have you tried that?

0 Karma

anshanno
Path Finder

Whoops, I meant specified earliest value. It doesn't stop returning log files when the search reaches the specified earliest value. That was my mistake.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...