Reporting

How to define time range of a saved search using Python SDK

debugger22
Engager

I'm trying to create a saved search with following

 kwargs = {                                                
    'description': 'failed auth',
    'is_scheduled' : True,
    'cron_schedule' : '*/5 * * * *',
    'start_time' : 'rt-5s@s',
    'end_time' : 'rt+5s@s'

It gives following error:

HTTPError: HTTP 400 Bad Request -- 
 In handler 'savedsearch': Argument "start_time" is not supported by this handler.

I've also tried earliest_time and latest_time but with no luck. Please help.

Thanks in advance!

1 Solution

SIddharth5794
Explorer

Instead of using as you did, the following will work.

 kwargs = {                                                
      'description': 'failed auth',
      'is_scheduled' : True,
      'cron_schedule' : '*/5 * * * *',
      'dispatch.earliest_time' : 'rt-5s@s',
      'dispatch.latest_time' : 'rt+5s@s'
  }

View solution in original post

jaywang66
Loves-to-Learn

This works for me. I plan to do more fine tuned filter.

rr = results.ResultsReader(service.jobs.export("search host=App1 index=ftp _indextime>=1627665310 _indextime<1627665313"))
0 Karma

SIddharth5794
Explorer

Instead of using as you did, the following will work.

 kwargs = {                                                
      'description': 'failed auth',
      'is_scheduled' : True,
      'cron_schedule' : '*/5 * * * *',
      'dispatch.earliest_time' : 'rt-5s@s',
      'dispatch.latest_time' : 'rt+5s@s'
  }

StewGoin1
Explorer

I think you need to use scheduled_times and arguments to it as part of your kwargs

From the Python SDK Docs for saved searches :

class splunklib.client.SavedSearch(service, path, **kwargs)
This class represents a saved search.



scheduled_times(earliest_time='now', latest_time='+1h') Returns the times when this search is scheduled to run.

By default this method returns the times in the next hour. For different time ranges, set earliest_time and latest_time. For example, for all times in the last day use “earliest_time=-1d” and “latest_time=now”.

Parameters:  earliest_time (string) – The earliest time. latest_time (string) – The latest time. Returns:    The list of search times.
0 Karma

SIddharth5794
Explorer

Solved

kwargs = {                                                
     'description': 'failed auth',
     'is_scheduled' : True,
     'cron_schedule' : '*/5 * * * *',
     'dispatch.earliest_time' : 'rt-5s@s',
     'dispatch.latest_time' : 'rt+5s@s'
 }
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...