Splunk Search

How to query Splunk API to only search for data for a particular time range?

rrahul963
Engager

i am trying to query splunk api from a c# application for a particular DateTime Range using below query

search index=iis host=wssecure* earliest=\"01/15/2015:09:00:00\" latest=\"01/15/2015:09:05:00\" | head 2

but what splunk is doing is that it runs the query for the DateTime range of earliest till now and then returns the data that falls between the dateTime range of earliest to latest (as specified in the query).
Due to this if the user wants to get the data in span of 15 min for a particular day in last week, splunk takes forever to return the data as the number of events to scan through is too large.

is there a way to query splunk api and make it scan data only for particular time frame?

Tags (3)

swbodie
Path Finder

I'm not sure if you are using the Splunk SDK for C# or not. However if you are there is a class called JobArgs that the CreateAsync method will accept which allows you to specify the earliest and latest time.

Here is an example of the creation method using the class:

Job job = await service.Jobs.CreateAsync(search, 0, ExecutionMode.Normal, new JobArgs{ EarliestTime = "@d", LatestTime = "now"}, null, DispatchState.Running).ConfigureAwait(false);
0 Karma

D2KSec1
Engager

I am also having this issue using Python. Using the Last 15 Minutes example above, the Web UI generates a URL containing 'earliest=-15m&latest=now'.

I pass those parameters in JSON format exactly as it is displayed. Anybody have clues?

{'earliest':'-15m', 'latest':'now'} when executed returns ALL TIME, not last 15 minutes.

nikos_d
Explorer

I am having exactly the same problem using the REST API in Python. Any help will be greatly appreciated

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...