Splunk API- Is there a way to retrieve what time range does a search use?

[latifismail]

Is there a way to retrieve what time range does a search use?,

I have tried using this endpoint

curl -k -u admin:pass https://localhost:8089/services/saved/searches/search_name/history

but i guess it is not returning its time range

Thank you

[isoutamo · Accepted solution]

Hi

You could try something like this

| rest /servicesNS/-/-/saved/searches/Name%20Of%20search f=title f=dispatch.earliest_time f=dispatch.latest_time f=auto_summarize.cron_schedule f=search f=next_scheduled_time
```| transpose```

Last transpose helps (w/o comment characters) to see what all field that query results.

Of course you could run this also on command line with curl.

r. Ismo