i am trying to search over REST API, seeing "All Time searches don't adhere to Splunk best practices" Error. Any policy on Splunk would block REST API searches ?
curl -u 'XXXX' -k https://splunkapi.example.com/services/search/jobs -d search='search index="webaccess" status=403 earliest_time=-1d'
curl -u 'XXXX' -k https://splunkapi.example.com/services/search/jobs -d search='search index="webaccess" status=403 earliest=-1d@d latest=now()'
<?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="FATAL">Please reduce your search to a smaller time range. All Time searches don't adhere to Splunk best practices</msg> </messages> </response>
... View more