Splunk Dev

Splunk python sdk - How to set custom time duration to run saved searches

pinpoint
Explorer

Hi All - I am new to splunk python SDK and am stuck with running saved searches for custom durations. So far, using the splunk documentation and examples I am able to execute saved searches using the python SDK, however I couldn't find a way to set the earliest/latest time parameters. Whatever the value I set the default duration for the saved search is used. Here is a snippet of what I have so far :

args = {"earliest_time":"-d60"}
job = searchName.dispatch(**args)

Tried this as well: args = {"earliestTime":"-d60"}

Is there a way to set custom duration for saved searches using python sdk?

Thanks.

0 Karma
1 Solution

pinpoint
Explorer

Sorry guys, I should have done some more research before posting the question. I did some poking around and got it to work. Here is what I set for duration:

args = {"dispatch.earliest_time":"-100d"}

View solution in original post

0 Karma

apruneda_splunk
Splunk Employee
Splunk Employee

Look at this example, specifically the format for earliest and latest times:
http://dev.splunk.com/view/SP-CAAAEE5#oneshotjob

This example shows how to set a time range in Python.

pinpoint
Explorer

Thanks for the link. The table 'Saved search parameters' had all the supported parameters.

0 Karma

pinpoint
Explorer

Sorry guys, I should have done some more research before posting the question. I did some poking around and got it to work. Here is what I set for duration:

args = {"dispatch.earliest_time":"-100d"}

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...