Splunk Search

How to pass the earliest ,latest time and span as arguments to the curl command to query a saved search

bubby248
New Member

I had the curl statement as below

curl -u username:password -k https://hostname:8089/services/search/jobs -d"search=| savedsearch mysavedsearch" -earliest_time="-24h@h" -latest_time="now" -d span="1hr"

But the response is as below
<?xml version="1.0" encoding="UTF-8"?>


Error in 'savedsearch' command: Encountered the following error while building a search for saved search 'mysavedsearch': Error while replacing variable name='earliest'. Could not find variable in the argument map.

Can you please help me out with the curl command
With this am expecting an SID, once I get the SID I will try to retreive the results.

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

First of all, it looks like you have an placeholder for a variable called earliest in your saved search. Probably you don't want that. But if you do want that, then you need to pass it as arguments to the | savedsearch command, within the search string, e.g., | savedsearch earliest=-24h@h.

But if you really don't want that, take it out of the saved search and just pass it as normal HTTP parameter in curl:

... -d earliest_time=-24h@h ...

0 Karma

bubby248
New Member

Thanks mate

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...