Hi,
I have built up a custom command in Splunk to search elastic search, but I found that I am unable to use the time range presets present in the dashboard right beside the search box. Changing the value to any time input doesn't make any change in my output. However, if I handle it through parameters in my search, it works fine. Here is a sample request from inspect job:
{
"adhoc_search_level": "verbose",
"auto_cancel": "30",
"custom.dispatch.earliest_time": "-15m",
"custom.dispatch.latest_time": "now",
"custom.display.general.type": "statistics",
"custom.display.page.search.tab": "statistics",
"custom.display.visualizations.charting.chart": "pie",
"custom.search": "| es",
"earliest_time": "-15m",
"indexedRealtime": null,
"latest_time": "now",
"preview": "1",
"rf": "*",
"search": "| es",
"status_buckets": "300",
"ui_dispatch_app": "splunk-elasticsearch"
}
Even iI choose last 15 min here, the search returns me output for entire duration. My sample output looks like this:
_time -raw
2015-07-10 18:11:18 Jul 10 14:09:14 host-135-144-122-234 abrt: detected unhandled Python exception in 'test.python' l
... View more
