Splunk Search

Splunk python sdk oneshot search: How to get earliest_time and latest_time in datetime format?

i2sheri
Communicator

I have a one shot search to which i am passing earliest time and latest time from time range picker. Trying to generate a report from the search results for which i need search time range as strings or python date objects.

For Ex:
Time Range: previous month
earliest_time: -1mon@mon
latest_time: @mon'

I need above times python date object
30-04-2015
31-05-2015

also my search ends with | chart count bla by date => the dates are columns which i couldn't see in ResultsReader

0 Karma
1 Solution

i2sheri
Communicator

you can use this search to get from and to dates


search index=* | head 1
|eval e=relative_time(now(), "-1mon@mon")
|eval l=relative_time(now(), "@mon")
|eval ee=strftime(e, "%m/%d/%Y:%H:%M:%S")
|eval ll=strftime(l, "%m/%d/%Y:%H:%M:%S")
|table e l ee ll

View solution in original post

0 Karma

i2sheri
Communicator

you can use this search to get from and to dates


search index=* | head 1
|eval e=relative_time(now(), "-1mon@mon")
|eval l=relative_time(now(), "@mon")
|eval ee=strftime(e, "%m/%d/%Y:%H:%M:%S")
|eval ll=strftime(l, "%m/%d/%Y:%H:%M:%S")
|table e l ee ll

0 Karma

i2sheri
Communicator

Those dates are present in result as columns (or keys)


search_results = service.jobs.oneshot(search_query, **kwargs)
reader = results.ResultsReader(search_results)
columns = reader[0].keys()

0 Karma

i2sheri
Communicator

This might no return all dates, it returns dates from search results. For Ex: If search did not return any events for 20-04-2015 then this date will not be present in reader[0].keys()

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...