I am sending a POST call to the REST endpoint search/jobs with following parameters:
'output_mode': 'json',
'earliest_time': '-7d',
'latest_time': '-1d',
'exec_mode': 'oneshot',
'search': 'search index=ind status=FAIL | table error, sim_time'
If, instead of above, I send:
'output_mode': 'json',
'exec_mode': 'oneshot',
'search': 'search index=ind earliest=-7d@d latest=-1d@d status=FAIL | table error, sim_time'
Is there a difference? In terms of performance, load on server, correctness etc.
... View more