I have a one shot search to which i am passing earliest time and latest time from time range picker. Trying to generate a report from the search results for which i need search time range as strings or python date objects.
For Ex:
Time Range: previous month
earliest_time: -1mon@mon
latest_time: @mon'
I need above times python date object
30-04-2015
31-05-2015
also my search ends with | chart count bla by date
=> the dates are columns which i couldn't see in ResultsReader
you can use this search to get from and to dates
search index=* | head 1
|eval e=relative_time(now(), "-1mon@mon")
|eval l=relative_time(now(), "@mon")
|eval ee=strftime(e, "%m/%d/%Y:%H:%M:%S")
|eval ll=strftime(l, "%m/%d/%Y:%H:%M:%S")
|table e l ee ll
you can use this search to get from and to dates
search index=* | head 1
|eval e=relative_time(now(), "-1mon@mon")
|eval l=relative_time(now(), "@mon")
|eval ee=strftime(e, "%m/%d/%Y:%H:%M:%S")
|eval ll=strftime(l, "%m/%d/%Y:%H:%M:%S")
|table e l ee ll
Those dates are present in result as columns (or keys)
search_results = service.jobs.oneshot(search_query, **kwargs)
reader = results.ResultsReader(search_results)
columns = reader[0].keys()
This might no return all dates, it returns dates from search results. For Ex: If search did not return any events for 20-04-2015 then this date will not be present in reader[0].keys()