- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi there,
I am trying to get the containers detials for stipulated time period, Lets say, Jan 1st 2023 - March 31st - 2023.
May I know what is the format here to get it from REST API. I am trying using below query and getting the results from the very latest conatiners as well.
Sample output: sharing only one key: value pair
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
This is the best one from a fellow trust member:
https://github.com/zamastyle/phantom_mhike/blob/main/Rest%20API%20Cheat%20Sheet.md
Feel free to mark as a solution to help others with similar issues/queries
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
This is the best one from a fellow trust member:
https://github.com/zamastyle/phantom_mhike/blob/main/Rest%20API%20Cheat%20Sheet.md
Feel free to mark as a solution to help others with similar issues/queries
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
@JoshiSri you need to add `_filter_<field>` to your query.
Also I am not sure about the page size but if you set it to 0 then you get all.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Superb..!! Again, on the mark. Is there any doc for these kind of parameters?
The one on the phantom doc is very on the higher level and is of no use if you want to drill down your search.
It helps, thanks a lot.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Awesome, worked like charm..!!
One last query, is there any limit for "page_size=40000" and "label='phishing'" this condition, is not working at all, is there a different way to parse label as phishing only containers?
Thanks again, for your quick response.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
@JoshiSri you need to use the lte/gte conditions in the REST call:
e.g.
/rest/container?_filter_start_time__gte="2023-01-01T00:00:00"&_filter_start_time__lte="2023-03-01T00:00:00"
Note the double "_" for the lte/gte
You can use python to create the date/time strings if you need to do this dynamically.
-- If this helped please mark as the solution. Happy SOARing --
![](/skins/images/FE4825B2128CA5F641629E007E333890/responsive_peak/images/icon_anonymous_message.png)