Splunk Dev

How to pass a time range using API

moe786
Explorer

So I am using the Splunk SDK with Python 3.7.x (splunklib) and am trying to figure out how to ask for data in a certain time range. Right now I'm simply passing it a query, but when I try to pass time, it just ignores the range and sends me all the data for the last few months of data.

Using this to run the job searches:

rr = results.ResultsReader(service.jobs.export(query))

How do I get data from a certain time range using the SDK?

0 Karma
1 Solution

sdchakraborty
Contributor

Hi,

In your query itself you can pass earliest and latest time. It will filter accordingly. Something like,

rr = results.ResultsReader(service.jobs.export("search index=_internal earliest=-1h | head 5"))

Sid

View solution in original post

jaywang66
Loves-to-Learn

This works for me. I plan to do more fine tune on the search filter.

rr = results.ResultsReader(service.jobs.export("search host=App1 index=ftp _indextime>=1627665310 _indextime<1627665313"))

0 Karma

sdchakraborty
Contributor

Hi,

In your query itself you can pass earliest and latest time. It will filter accordingly. Something like,

rr = results.ResultsReader(service.jobs.export("search index=_internal earliest=-1h | head 5"))

Sid

moe786
Explorer

Do I need to worry about stuff like the time format or having it in %H-%M-%S format or something?

0 Karma

sdchakraborty
Contributor

I think you need to convert them to epoch format before you pass them to earliest or latest.

0 Karma

moe786
Explorer

So it would be earliest=-epochformedtime ?

0 Karma

sdchakraborty
Contributor

when you are giving epoch for earliest and latest no need to give negative number.

0 Karma

moe786
Explorer

okay tyvm

0 Karma

sdchakraborty
Contributor

Hi,

If you fine with the answer please accept it as answer. I have converted my comment as answer.

Sid

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...