I am not getting consistent result - it looks very weird... sending time in epoch ("1566872999.000000")as well date string (""08/27/2019:07:59:59","%m/%d/%Y:%H:%M:%S") works but I am getting different start boundary (means in both file log start from different time) for the following two example. {'search': 'search source=*kong_access* earliest=08/01/2019:0:0:0 latest=08/01/2019:23:59:59 http_apikey | fields - host,source,sourcetype, splunk_server, _time, index, _serial', 'output_mode': 'csv'} {'search': 'search source=*kong_access* earliest=08/01/2019:0:0:0 latest=08/08/2019:23:59:59 http_apikey | fields - host,source,sourcetype, splunk_server, _time, index, _serial', 'output_mode': 'csv'} ... View more

Seems it's working, it means earliest and latest should be part of the search string. Now Only issue I am facing is some timezone related: When I am sending earliest= 08/24/2019:0:0:0 --> Log start from 08/24/2019:07:00:00 latest=08/28/2019:23:59:59 -->Log ends to 08/29/2019:07:00:00 Writing logs to file: /Users/i844276/Kong_log_08_01_2019_08_08_2019/kong_access_log_PROD_US_08_01_2019_0_0_0_08_08_2019_23_59_59.csv Inside sessoin py {'search': 'search source=*kong_access* earliest=08/01/2019:0:0:0 latest=08/08/2019:23:59:59 http_apikey | fields - host,source,sourcetype, splunk_server, _time, index, _serial', 'output_mode': 'csv'} Request and kwargs is ........ https:MACHINENAME:8089/services/search/jobs/export {'response': []} search=search+source%3D%2Akong_access%2A+earliest%3D08%2F01%2F2019%3A0%3A0%3A0++latest%3D08%2F08%2F2019%3A23%3A59%3A59+http_apikey+%7C+fields+-+host%2Csource%2Csourcetype%2C+splunk_server%2C+_time%2C+index%2C+_serial&output_mode=csv {'timeout': None, 'allow_redirects': True, 'verify': False, 'proxies': OrderedDict(), 'stream': True, 'cert': None} ... View more

same result no -change - getting data from AUG 24 - AUG 30 {'search': 'search source=*kong_access* http_apikey | fields - host,source,sourcetype, splunk_server, _time, index, _serial', 'output_mode': 'csv', 'earliest': '1567017000.000000'} Request and kwargs is ........ https://MACHINENAME:8089/services/search/jobs/export {'response': []} search=search+source%3D%2Akong_access%2A+http_apikey+%7C+fields+-+host%2Csource%2Csourcetype%2C+splunk_server%2C+_time%2C+index%2C+_serial&output_mode=csv&earliest=1567017000.000000 {'timeout': None, 'allow_redirects': True, 'verify': False, 'proxies': OrderedDict(), 'stream': True, 'cert': None} ... View more

No change same result as before, here is the hardcoded info {'search': 'search source=*kong_access* http_apikey | fields - host,source,sourcetype, splunk_server, _time, index, _serial', 'output_mode': 'csv', 'earliest': '-3h', 'latest': '-1h'} Request and kwargs is ........ https://MAHCINENAME:8089/services/search/jobs/export {'response': []} search=search+source%3D%2Akong_access%2A+http_apikey+%7C+fields+-+host%2Csource%2Csourcetype%2C+splunk_server%2C+_time%2C+index%2C+_serial&output_mode=csv&earliest=-3h&latest=-1h {'timeout': None, 'allow_redirects': True, 'verify': False, 'proxies': OrderedDict(), 'stream': True, 'cert': None} ... View more

I've updated code to use date object as below but still I am not getting data in my date range but I noticed it's from now - 7 days of data. earliest = datetime.strptime(self.earliest, "%m/%d/%Y:%H:%M:%S") latest = datetime.strptime(self.latest, "%m/%d/%Y:%H:%M:%S") here is my Json data {'search': 'search source=kong_access http_apikey | fields - host,source,sourcetype, splunk_server, _time, index, _serial', 'output_mode': 'csv', 'earliest': datetime.datetime(2019, 8, 15, 0, 0), 'latest': datetime.datetime(2019, 8, 15, 23, 59, 59)} ... View more