Are there any examples of an actual use case of dispatch.data_format for fields earliest time and latest time?

[meduriphani]

Hi,

I am looking for any sample code in any language/script that shows an actual use case of dispatch.data_format for setting up the fields dispatch.earliest time and dispatch.latest time?

Thanks,
Phanendra Meduri

[somesoni2]

The attribute dispatch.time_format is used when you specify the earliest (Start time) and latest (Finish time) of the saved search in string formatted dates. If it's relative ( e.g. -1d@d ) or epoch, then this property is not useful. If you want to specify the earliest as absolute date e.g. earliest=2017-02-06 11:00 PM , then you should set dispatch.time_format=%Y-%m-%d %H:%M %p. If your absolute date format is same as it's default value, then no need to specify that.

dispatch.time_format = <time format str>
* Defines the time format that Splunk uses to specify the earliest and latest
  time.
* Defaults to %FT%T.%Q%:z

[meduriphani]

Hi,

Thanks for your reply.

This would be very useful If I get any example.

I am using Groovy to retrieve savedSearch results. My code is continuously failing because of data format.

            def etime=request.headers.get("earliestTime")
            def ltime=request.headers.get("LatestTime")
             dispatchArgs.setDispatchTimeFormat("yyyy-MM-dd'T'HH:mm:ss.mmm-05:00")
             dispatchArgs.setDispatchEarliestTime(etime)
             dispatchArgs.setDispatchLatestTime(ltime)
            Job job = savedSearch.dispatch(dispatchArgs)

I am getting the earliestTime and LatestTime in the date-format of pattern="yyyy-MM-dd'T'HH:mm:ss.mmm-05:00".

It would be helpful If you point where the above code going wrong. OR practical any example.

I referenced the above code from http://dev.splunk.com/view/java-sdk/SP-CAAAEKY

Thanks,
Phanendra Meduri