i am trying to search over REST API, seeing "All Time searches don't adhere to Splunk best practices" Error. Any policy on Splunk would block REST API searches ?
curl -u 'XXXX' -k https://splunkapi.example.com/services/search/jobs -d search='search index="webaccess" status=403 earliest_time=-1d'
curl -u 'XXXX' -k https://splunkapi.example.com/services/search/jobs -d search='search index="webaccess" status=403 earliest=-1d@d latest=now()'
<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="FATAL">Please reduce your search to a smaller time range. All Time searches don't adhere to Splunk best practices</msg>
</messages>
</response>
Try specifying timerange as parameters to the rest call, not as parameters within the search.