Hi Splunkers,
I need to search alerts triggered for my app in the given time range. The time range is selected from time range picker. Do anyone have any inputs?
I am struggling with:
| rest /servicesNS/-/-/saved/searches search="eai:acl.app=test AND disabled=0" | table title eai:acl.app eai:acl.owner disabled is_scheduled cron_schedule
but this gives consistent result irrespective of time selected.
please help with some pointers
Best,
Specifying time ranges with the rest
command is a little wonky, but it's totally doable. Here's an example, which would search over yesterday:
| rest /servicesNS/-/-/saved/searches search="eai:acl.app=test AND disabled=0" earliest_time=`time_modifier(-1d@d)` latest_time=`time_modifier(@d)`
| table title eai:acl.app eai:acl.owner disabled is_scheduled cron_schedule
The time modifiers you can use are the ones documented here: http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/SearchTimeModifiers