Getting Data In

earliest_time not working in REST post data, but working in search

shikhanshu
Path Finder

I am sending a POST request to Splunk REST 'services/search/jobs' endpoint.

If I submit with 'earliest_time' parameter as a relative string like -2d, it works fine. But if I use an absolute date-time string like "9/24/2017:10:00:00", it comes back with 0 results.

Instead, if I don't pass earliest_time parameter, and embed the earliest in the query itself like "earliest='9/24/2017:10:00:00'", it works fine.

Is this a known bug? Or am I doing something wrong?

0 Karma
1 Solution

xavierashe
Contributor

Use dashes instead of slashes:

curl -k -u user https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=firewalls dest=%22172.0.0.1%22" -d output_mode=raw -d earliest_time="2017-01-01T00:00:00.000-04:00"

View solution in original post

0 Karma

xavierashe
Contributor

Use dashes instead of slashes:

curl -k -u user https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=firewalls dest=%22172.0.0.1%22" -d output_mode=raw -d earliest_time="2017-01-01T00:00:00.000-04:00"
0 Karma

shikhanshu
Path Finder

Dashes is what I have always had anyway. In any case, I have switched over the embedding the 'earliest_time' in the query itself rather than as a separate data item in POST request and that works fine. So I will just stick to that. Thanks for the response!

0 Karma

shikhanshu
Path Finder

I did try with "YYYY-mm-dd:H:i:s" format and that works!

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Passing the values in the search SPL itself overrides the earliest= parameter from the interface, so that doesn't tell you why you are having the interface issue.

I suspect it is an issue with quoting. Try setting the value to...

"09/24/2017:10:00:00"
0 Karma

shikhanshu
Path Finder

I was not sending 'earliest' in the SPL query earlier. I was sending 'earliest_time' parameter from the interface. Since latter did not work for absolute datetime string, I now switched to 'earliest' in SPL itself which works.

I went back to sending 'earliest_time' and tried adding " around the value. That did not help. Splunk still comes back with 0 results.

I am ok with using 'earliest=' in SPL, unless it is less efficient or not recommended, as compared to 'earliest_time' from interface.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...