python - 如何使用 Splunk-Python SDK 将 'time' 查询传递给 splunk 企业？

Question

I am trying to pass query from Python(eclipse IDE) to extract data from specific dashboard on SPLUNK enterprises. I am able to get data printed on my console by passing the required queries however I am not able to extract data for specific time interval(like if I want data for 1 hour, 1 day, 1 week or 1 month)

我已经尝试过像“最早”、“最新”这样的命令以及我的查询，但每次它都会抛出一个错误，指出 “raise HTTPError(response) splunklib.binding.HTTPError: HTTP 400 Bad Request -- Search Factory : 未知搜索命令“最早””

这是我的代码

import splunklib.client as client
import splunklib.results as results


HOST = "my hostname"
PORT = 8089
USERNAME = "my username"
PASSWORD = "my password"
service = client.connect(
host=HOST,
port=PORT, 
username=USERNAME,
password=PASSWORD)
rr = results.ResultsReader(service.jobs.export("search index=ccmjimmie | stats count(eval(resCode!=00200)) AS errored | chart sum(errored)|earliest=-1d"))

for result in rr:
    if isinstance(result, results.Message):
    # Diagnostic messages might be returned in the results
        print(result.type, result.message)
    elif isinstance(result, dict):
    # Normal events are returned as dicts
        print (result)
assert rr.is_preview == False

不使用时间查询得到的输出

OrderedDict([('sum(errored)', '1566')])
OrderedDict([('sum(errored)', '4404')])
OrderedDict([('sum(errored)', '6655')])
OrderedDict([('sum(errored)', '8992')])
etc...

此输出与预期相同，但不受时间限制。我想要相同的输出，但对于给定的时间间隔。时间间隔应该从上述 Python 代码中的搜索查询“serch.jobs.export()”传递

请告诉我如何将“时间”查询与我所需的查询一起传递。

非常感谢任何帮助!提前致谢!

Answer 1

您必须将最早的放在搜索的开头。示例 - 距现在 1 天:

“search index=ccmjimmie earliest=-1d | stats count(eval(resCode!=00200)) AS errored | chart sum(errored)”

详情请看这里:https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/SearchTimeModifiers