Splunk Search

earliest and latest information in custom python search command

sbsbb
Builder

I was not able to find in the doc a way to get earliest and latest information from the datetimepicker to use in my generating custom search command..

Any Idea how that work ?

lumpymilk
Explorer

For the sake of anyone searching and finding this, these return a float that matches time picker when I try them. I just wish I could find inheritable or nested Option() types so I can borrow those with their existing validation.

earliest = self.search_results_info.api_et
latest = self.search_results_info.api_lt

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could prefix the call to your custom generating command like this:

| stats count | addinfo | your_command

That way you should get info about the time range as input events for your command.

I don't think there's an intended way for accessing this directly - any more. Taken from the doc of splunk.Intersplunk:

getOrganizedResults(input_str=None)
    Converts an Intersplunk-formatted file object into a dict
    representation of the contained events, and returns a tuple of:

        (results, dummyresults, settings)

    "dummyresults" is always an empty list, and "settings" is always
    an empty dict, since the change to csv stopped sending the
    searchinfo.  It has not been updated to store the auth token.

My guess is you're looking for what used to be in searchinfo.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...