i am trying to query splunk api from a c# application for a particular DateTime Range using below query search index=iis host=wssecure* earliest=\"01/15/2015:09:00:00\" latest=\"01/15/2015:09:05:00\" | head 2 but what splunk is doing is that it runs the query for the DateTime range of earliest till now and then returns the data that falls between the dateTime range of earliest to latest (as specified in the query). Due to this if the user wants to get the data in span of 15 min for a particular day in last week, splunk takes forever to return the data as the number of events to scan through is too large. is there a way to query splunk api and make it scan data only for particular time frame? ... View more