79338697

Date: 2025-01-08 10:11:42
Score: 1
Natty:
Report link

In the event that someone else is stumbling upon this question while having the same issue : you need to specify the parameter "time_format", as mentionned in the documentation here :

https://docs.splunk.com/Documentation/Splunk/9.4.0/RESTREF/RESTsearch#search.2Fjobs.2Fexport

It defaults to %FT%T.%Q%:z.

In your case, if you are looking for an ISO formatting, you need to specify %Y-%m-%dT%H:%M:%S.%Q%:z

The documentation about the various time formats used by Splunk is available here : https://docs.splunk.com/Documentation/Splunk/9.4.0/SearchReference/Commontimeformatvariables

Note that this also applies to Splunk Python SDK, where you need to pass the "time_format" field as a kwargs

Reasons:
  • Whitelisted phrase (-1): In your case
  • Long answer (-0.5):
  • Has code block (-0.5):
  • Me too answer (2.5): having the same issue
  • Low reputation (0.5):
Posted by: Shade