如何使用splunkpythonsdk向splunk企业传递“时间”查询？

Question

I am trying to pass query from Python(eclipse IDE) to extract data from specific dashboard on SPLUNK enterprises. I am able to get data printed on my console by passing the required queries however I am not able to extract data for specific time interval(like if I want data for 1 hour, 1 day, 1 week or 1 month)

我在查询中尝试过'earliest'、'latest'等命令，但每次它都抛出错误，声明“raise HTTPError（response）”splunklib.binding.HTTPError错误的工厂搜索：错误的“工厂搜索”命令“>

这是我的代码

import splunklib.client as client
import splunklib.results as results


HOST = "my hostname"
PORT = 8089
USERNAME = "my username"
PASSWORD = "my password"
service = client.connect(
host=HOST,
port=PORT, 
username=USERNAME,
password=PASSWORD)
rr = results.ResultsReader(service.jobs.export("search index=ccmjimmie | stats count(eval(resCode!=00200)) AS errored | chart sum(errored)|earliest=-1d"))

for result in rr:
    if isinstance(result, results.Message):
    # Diagnostic messages might be returned in the results
        print(result.type, result.message)
    elif isinstance(result, dict):
    # Normal events are returned as dicts
        print (result)
assert rr.is_preview == False

未使用时间查询得到的输出

^{pr2}$

此输出与预期相同，但不受时间限制。我想要相同的输出，但是在给定的时间间隔内。从搜索查询中传递时间间隔“serch.jobs.出口在上面的Python代码中

请告诉我如何通过“时间”查询和我所需的查询。在

任何帮助都是非常感谢的！提前谢谢！在

Answer 1

你得把最早的放在搜索的开始。例如-1天到现在为止：

“search index=ccmjimmie earliest=-1d |统计计数（eval（resCode！=00200）错误|图表和（错误）

详情请参阅此处：https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/SearchTimeModifiers