python之如何使用 Splunk-Python SDK 将 'time' 查询传递给 splunk 企业

I am trying to pass query from Python(eclipse IDE) to extract data from specific dashboard on SPLUNK enterprises. I am able to get data printed on my console by passing the required queries however I am not able to extract data for specific time interval(like if I want data for 1 hour, 1 day, 1 week or 1 month)

我已经尝试过像“最早”、“最新”这样的命令以及我的查询，但每次它都会抛出一个错误，指出 “raise HTTPError(response) splunklib.binding.HTTPError: HTTP 400 Bad Request -- Search Factory : 未知搜索命令“最早””

这是我的代码

import splunklib.client as client 
import splunklib.results as results 
 
 
HOST = "my hostname" 
PORT = 8089 
USERNAME = "my username" 
PASSWORD = "my password" 
service = client.connect( 
host=HOST, 
port=PORT,  
username=USERNAME, 
password=PASSWORD) 
rr = results.ResultsReader(service.jobs.export("search index=ccmjimmie | stats count(eval(resCode!=00200)) AS errored | chart sum(errored)|earliest=-1d")) 
 
for result in rr: 
    if isinstance(result, results.Message): 
    # Diagnostic messages might be returned in the results 
        print(result.type, result.message) 
    elif isinstance(result, dict): 
    # Normal events are returned as dicts 
        print (result) 
assert rr.is_preview == False 

不使用时间查询得到的输出

OrderedDict([('sum(errored)', '1566')]) 
OrderedDict([('sum(errored)', '4404')]) 
OrderedDict([('sum(errored)', '6655')]) 
OrderedDict([('sum(errored)', '8992')]) 
etc... 

此输出与预期相同，但不受时间限制。我想要相同的输出，但对于给定的时间间隔。时间间隔应该从上述 Python 代码中的搜索查询“serch.jobs.export()”传递

请告诉我如何将“时间”查询与我所需的查询一起传递。

非常感谢任何帮助!提前致谢!

请您参考如下方法:

您必须将最早的放在搜索的开头。示例 - 距现在 1 天:

“search index=ccmjimmie earliest=-1d | stats count(eval(resCode!=00200)) AS errored | chart sum(errored)”

详情请看这里:https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/SearchTimeModifiers