I'm trying to automate a search using the REST API to provide a list of events that occur x seconds before and after a specific event. Similar to the nearby events functionality but I won't be using the same search criteria.
Here's what I'm shooting for. I've got the first two steps down but I'm not sure how handle the time window. Any suggestions?
I worked out my issue. The request to the API needed the latest_time and earliest_time values and I was providing an absolute time. I needed to use the time_format in my request to indicate the format I was using for my absolute time.
Not sure what piece you're stuck on. Maybe sharing what you've tried will assist with getting a better answer.
Have you looked at https://answers.splunk.com/answers/509911/what-is-the-correct-earliest-time-format-for-searc-1.html ?
...Laurie:{)