Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Can't get events older than today.

$
0
0

I am using the splunk PHP SDK and it seems like everything is golden. I am using offset and count to iterate through the result set. Issue i am running into is it seems that i can't get any events older than today. Checking the GUI on the server shows back multiple days, but for some reason the SDK won't go back past today.

$offset = ($_GET['page']-1)*20;
$searchExpression= 'search host="'.$node['IP'].'" | search squid';
$searchParams = array(
    'count' => 30,
    'offset' => $offset,
    'earliest_time' => '2012-06-19T12:00:00.000-07:00', 
    'latest_time' => '2013-12-02T12:00:00.000-07:00'
);

$resultsXmlString = $service->getJobs()->createOneshot($searchExpression, $searchParams);

Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>