Hi,
I am looking for any sample code in any language/script that shows an actual use case of dispatch.data_format for setting up the fields dispatch.earliest time and dispatch.latest time?
Thanks,
Phanendra Meduri
The attribute dispatch.time_format
is used when you specify the earliest (Start time) and latest (Finish time) of the saved search in string formatted dates. If it's relative ( e.g. -1d@d
) or epoch, then this property is not useful. If you want to specify the earliest as absolute date e.g. earliest=2017-02-06 11:00 PM
, then you should set dispatch.time_format=%Y-%m-%d %H:%M %p
. If your absolute date format is same as it's default value, then no need to specify that.
dispatch.time_format = <time format str>
* Defines the time format that Splunk uses to specify the earliest and latest
time.
* Defaults to %FT%T.%Q%:z
Hi,
Thanks for your reply.
This would be very useful If I get any example.
I am using Groovy to retrieve savedSearch results. My code is continuously failing because of data format.
def etime=request.headers.get("earliestTime")
def ltime=request.headers.get("LatestTime")
dispatchArgs.setDispatchTimeFormat("yyyy-MM-dd'T'HH:mm:ss.mmm-05:00")
dispatchArgs.setDispatchEarliestTime(etime)
dispatchArgs.setDispatchLatestTime(ltime)
Job job = savedSearch.dispatch(dispatchArgs)
I am getting the earliestTime and LatestTime in the date-format of pattern="yyyy-MM-dd'T'HH:mm:ss.mmm-05:00".
It would be helpful If you point where the above code going wrong. OR practical any example.
I referenced the above code from http://dev.splunk.com/view/java-sdk/SP-CAAAEKY
Thanks,
Phanendra Meduri