Splunk Search

What timeframe do REST API searches use?

random_event
Explorer

I need to count the number of times an alert has triggered in a specific time window (say, last 24 hours).  I am trying to do that via  | rest   but noticed the counts remain constant despite changing the search time interval (60m, yesterday, last 7d, 15m, etc.).

What "time" does the | rest search or return results for?  I tried reading the docs on rest and and the user manual for REST API but nothing quite explains it.

Current SPL

 

 

| rest /services/alerts/fired_alerts splunk_server=local
| search author="me@me.com"
| table eai:acl.app eai:acl.owner id title triggered_alert_count 
| rename eai:acl.* as *, app as App, owner as Owner, id as Endpoint, title as Title, triggered_alert_count as "Count of Triggered Alerts"

 

 

 

Labels (3)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@random_event - Most of the | rest command gives constant output regardless of time-range selected.

So if you want something specific, then you have to filter with | where condition. So look at the results there must be some field in it with time in it, on which you can apply the where condition to filter as you like.

 

I hope this helps, upvote if it does!!!

rohit1793
Explorer

Hello @random_event ,

It pulls whatever you have at that endpoint for all time.for example if you want to know all the KO belongs to x person you can filter it and see all the enabled and disabled KO’s belongs to the x.

 

Rohit Joshi
Splunk Architect

random_event
Explorer

Okay, so REST will query all available data as you said for "all time".  How is the time determined?  Is it based on the retention of internal indexes (mine is set to 60d)?

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...