Splunk Dev

Splunk python sdk - How to set custom time duration to run saved searches

pinpoint
Explorer

Hi All - I am new to splunk python SDK and am stuck with running saved searches for custom durations. So far, using the splunk documentation and examples I am able to execute saved searches using the python SDK, however I couldn't find a way to set the earliest/latest time parameters. Whatever the value I set the default duration for the saved search is used. Here is a snippet of what I have so far :

args = {"earliest_time":"-d60"}
job = searchName.dispatch(**args)

Tried this as well: args = {"earliestTime":"-d60"}

Is there a way to set custom duration for saved searches using python sdk?

Thanks.

0 Karma
1 Solution

pinpoint
Explorer

Sorry guys, I should have done some more research before posting the question. I did some poking around and got it to work. Here is what I set for duration:

args = {"dispatch.earliest_time":"-100d"}

View solution in original post

0 Karma

apruneda_splunk
Splunk Employee
Splunk Employee

Look at this example, specifically the format for earliest and latest times:
http://dev.splunk.com/view/SP-CAAAEE5#oneshotjob

This example shows how to set a time range in Python.

pinpoint
Explorer

Thanks for the link. The table 'Saved search parameters' had all the supported parameters.

0 Karma

pinpoint
Explorer

Sorry guys, I should have done some more research before posting the question. I did some poking around and got it to work. Here is what I set for duration:

args = {"dispatch.earliest_time":"-100d"}

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...