GetSplunk 2.0.0

Bundle
org.apache.nifi | nifi-splunk-nar
Description
Retrieves data from Splunk Enterprise.
Tags
get, logs, splunk
Input Requirement
FORBIDDEN
Supports Sensitive Dynamic Properties
false
Properties
  • Application
    The Splunk Application to query.
    Display Name
    Application
    Description
    The Splunk Application to query.
    API Name
    Application
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    false
  • Connection Timeout
    Max wait time for connection to the Splunk server.
    Display Name
    Connection Timeout
    Description
    Max wait time for connection to the Splunk server.
    API Name
    Connection Timeout
    Default Value
    5 secs
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    false
  • Earliest Time
    The value to use for the earliest time when querying. Only used with a Time Range Strategy of Provided. See Splunk's documentation on Search Time Modifiers for guidance in populating this field.
    Display Name
    Earliest Time
    Description
    The value to use for the earliest time when querying. Only used with a Time Range Strategy of Provided. See Splunk's documentation on Search Time Modifiers for guidance in populating this field.
    API Name
    Earliest Time
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    false
  • Hostname
    The ip address or hostname of the Splunk server.
    Display Name
    Hostname
    Description
    The ip address or hostname of the Splunk server.
    API Name
    Hostname
    Default Value
    localhost
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    true
  • Latest Time
    The value to use for the latest time when querying. Only used with a Time Range Strategy of Provided. See Splunk's documentation on Search Time Modifiers for guidance in populating this field.
    Display Name
    Latest Time
    Description
    The value to use for the latest time when querying. Only used with a Time Range Strategy of Provided. See Splunk's documentation on Search Time Modifiers for guidance in populating this field.
    API Name
    Latest Time
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    false
  • Output Mode
    The output mode for the results.
    Display Name
    Output Mode
    Description
    The output mode for the results.
    API Name
    Output Mode
    Default Value
    JSON
    Allowable Values
    • ATOM
    • CSV
    • JSON
    • JSON_COLS
    • JSON_ROWS
    • RAW
    • XML
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    true
  • Owner
    The owner to pass to Splunk.
    Display Name
    Owner
    Description
    The owner to pass to Splunk.
    API Name
    Owner
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    false
  • Password
    The password to authenticate to Splunk.
    Display Name
    Password
    Description
    The password to authenticate to Splunk.
    API Name
    Password
    Expression Language Scope
    Not Supported
    Sensitive
    true
    Required
    false
  • Port
    The port of the Splunk server.
    Display Name
    Port
    Description
    The port of the Splunk server.
    API Name
    Port
    Default Value
    8089
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    true
  • Query
    The query to execute. Typically beginning with a <search> command followed by a search clause, such as <search source="tcp:7689"> to search for messages received on TCP port 7689.
    Display Name
    Query
    Description
    The query to execute. Typically beginning with a <search> command followed by a search clause, such as <search source="tcp:7689"> to search for messages received on TCP port 7689.
    API Name
    Query
    Default Value
    search * | head 100
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    true
  • Read Timeout
    Max wait time for response from the Splunk server.
    Display Name
    Read Timeout
    Description
    Max wait time for response from the Splunk server.
    API Name
    Read Timeout
    Default Value
    15 secs
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    false
  • Scheme
    The scheme for connecting to Splunk.
    Display Name
    Scheme
    Description
    The scheme for connecting to Splunk.
    API Name
    Scheme
    Default Value
    https
    Allowable Values
    • https
    • http
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    true
  • Security Protocol
    The security protocol to use for communicating with Splunk.
    Display Name
    Security Protocol
    Description
    The security protocol to use for communicating with Splunk.
    API Name
    Security Protocol
    Default Value
    TLSv1_2
    Allowable Values
    • TLSv1_2
    • TLSv1_1
    • TLSv1
    • SSLv3
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    false
  • SSL Context Service
    The SSL Context Service used to provide client certificate information for TLS/SSL connections.
    Display Name
    SSL Context Service
    Description
    The SSL Context Service used to provide client certificate information for TLS/SSL connections.
    API Name
    SSL Context Service
    Service Interface
    org.apache.nifi.ssl.SSLContextService
    Service Implementations
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    false
  • Time Field Strategy
    Indicates whether to search by the time attached to the event, or by the time the event was indexed in Splunk.
    Display Name
    Time Field Strategy
    Description
    Indicates whether to search by the time attached to the event, or by the time the event was indexed in Splunk.
    API Name
    Time Field Strategy
    Default Value
    Event Time
    Allowable Values
    • Event Time
    • Index Time
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    true
  • Time Range Strategy
    Indicates how to apply time ranges to each execution of the query. Selecting a managed option allows the processor to apply a time range from the last execution time to the current execution time. When using <Managed from Beginning>, an earliest time will not be applied on the first execution, and thus all records searched. When using <Managed from Current> the earliest time of the first execution will be the initial execution time. When using <Provided>, the time range will come from the Earliest Time and Latest Time properties, or no time range will be applied if these properties are left blank.
    Display Name
    Time Range Strategy
    Description
    Indicates how to apply time ranges to each execution of the query. Selecting a managed option allows the processor to apply a time range from the last execution time to the current execution time. When using <Managed from Beginning>, an earliest time will not be applied on the first execution, and thus all records searched. When using <Managed from Current> the earliest time of the first execution will be the initial execution time. When using <Provided>, the time range will come from the Earliest Time and Latest Time properties, or no time range will be applied if these properties are left blank.
    API Name
    Time Range Strategy
    Default Value
    Provided
    Allowable Values
    • Managed from Beginning
    • Managed from Current
    • Provided
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    true
  • Time Zone
    The Time Zone to use for formatting dates when performing a search. Only used with Managed time strategies.
    Display Name
    Time Zone
    Description
    The Time Zone to use for formatting dates when performing a search. Only used with Managed time strategies.
    API Name
    Time Zone
    Default Value
    UTC
    Allowable Values
    • Africa/Abidjan
    • Africa/Accra
    • Africa/Addis_Ababa
    • Africa/Algiers
    • Africa/Asmara
    • Africa/Asmera
    • Africa/Bamako
    • Africa/Bangui
    • Africa/Banjul
    • Africa/Bissau
    • Africa/Blantyre
    • Africa/Brazzaville
    • Africa/Bujumbura
    • Africa/Cairo
    • Africa/Casablanca
    • Africa/Ceuta
    • Africa/Conakry
    • Africa/Dakar
    • Africa/Dar_es_Salaam
    • Africa/Djibouti
    • Africa/Douala
    • Africa/El_Aaiun
    • Africa/Freetown
    • Africa/Gaborone
    • Africa/Harare
    • Africa/Johannesburg
    • Africa/Juba
    • Africa/Kampala
    • Africa/Khartoum
    • Africa/Kigali
    • Africa/Kinshasa
    • Africa/Lagos
    • Africa/Libreville
    • Africa/Lome
    • Africa/Luanda
    • Africa/Lubumbashi
    • Africa/Lusaka
    • Africa/Malabo
    • Africa/Maputo
    • Africa/Maseru
    • Africa/Mbabane
    • Africa/Mogadishu
    • Africa/Monrovia
    • Africa/Nairobi
    • Africa/Ndjamena
    • Africa/Niamey
    • Africa/Nouakchott
    • Africa/Ouagadougou
    • Africa/Porto-Novo
    • Africa/Sao_Tome
    • Africa/Timbuktu
    • Africa/Tripoli
    • Africa/Tunis
    • Africa/Windhoek
    • America/Adak
    • America/Anchorage
    • America/Anguilla
    • America/Antigua
    • America/Araguaina
    • America/Argentina/Buenos_Aires
    • America/Argentina/Catamarca
    • America/Argentina/ComodRivadavia
    • America/Argentina/Cordoba
    • America/Argentina/Jujuy
    • America/Argentina/La_Rioja
    • America/Argentina/Mendoza
    • America/Argentina/Rio_Gallegos
    • America/Argentina/Salta
    • America/Argentina/San_Juan
    • America/Argentina/San_Luis
    • America/Argentina/Tucuman
    • America/Argentina/Ushuaia
    • America/Aruba
    • America/Asuncion
    • America/Atikokan
    • America/Atka
    • America/Bahia
    • America/Bahia_Banderas
    • America/Barbados
    • America/Belem
    • America/Belize
    • America/Blanc-Sablon
    • America/Boa_Vista
    • America/Bogota
    • America/Boise
    • America/Buenos_Aires
    • America/Cambridge_Bay
    • America/Campo_Grande
    • America/Cancun
    • America/Caracas
    • America/Catamarca
    • America/Cayenne
    • America/Cayman
    • America/Chicago
    • America/Chihuahua
    • America/Ciudad_Juarez
    • America/Coral_Harbour
    • America/Cordoba
    • America/Costa_Rica
    • America/Creston
    • America/Cuiaba
    • America/Curacao
    • America/Danmarkshavn
    • America/Dawson
    • America/Dawson_Creek
    • America/Denver
    • America/Detroit
    • America/Dominica
    • America/Edmonton
    • America/Eirunepe
    • America/El_Salvador
    • America/Ensenada
    • America/Fort_Nelson
    • America/Fort_Wayne
    • America/Fortaleza
    • America/Glace_Bay
    • America/Godthab
    • America/Goose_Bay
    • America/Grand_Turk
    • America/Grenada
    • America/Guadeloupe
    • America/Guatemala
    • America/Guayaquil
    • America/Guyana
    • America/Halifax
    • America/Havana
    • America/Hermosillo
    • America/Indiana/Indianapolis
    • America/Indiana/Knox
    • America/Indiana/Marengo
    • America/Indiana/Petersburg
    • America/Indiana/Tell_City
    • America/Indiana/Vevay
    • America/Indiana/Vincennes
    • America/Indiana/Winamac
    • America/Indianapolis
    • America/Inuvik
    • America/Iqaluit
    • America/Jamaica
    • America/Jujuy
    • America/Juneau
    • America/Kentucky/Louisville
    • America/Kentucky/Monticello
    • America/Knox_IN
    • America/Kralendijk
    • America/La_Paz
    • America/Lima
    • America/Los_Angeles
    • America/Louisville
    • America/Lower_Princes
    • America/Maceio
    • America/Managua
    • America/Manaus
    • America/Marigot
    • America/Martinique
    • America/Matamoros
    • America/Mazatlan
    • America/Mendoza
    • America/Menominee
    • America/Merida
    • America/Metlakatla
    • America/Mexico_City
    • America/Miquelon
    • America/Moncton
    • America/Monterrey
    • America/Montevideo
    • America/Montreal
    • America/Montserrat
    • America/Nassau
    • America/New_York
    • America/Nipigon
    • America/Nome
    • America/Noronha
    • America/North_Dakota/Beulah
    • America/North_Dakota/Center
    • America/North_Dakota/New_Salem
    • America/Nuuk
    • America/Ojinaga
    • America/Panama
    • America/Pangnirtung
    • America/Paramaribo
    • America/Phoenix
    • America/Port-au-Prince
    • America/Port_of_Spain
    • America/Porto_Acre
    • America/Porto_Velho
    • America/Puerto_Rico
    • America/Punta_Arenas
    • America/Rainy_River
    • America/Rankin_Inlet
    • America/Recife
    • America/Regina
    • America/Resolute
    • America/Rio_Branco
    • America/Rosario
    • America/Santa_Isabel
    • America/Santarem
    • America/Santiago
    • America/Santo_Domingo
    • America/Sao_Paulo
    • America/Scoresbysund
    • America/Shiprock
    • America/Sitka
    • America/St_Barthelemy
    • America/St_Johns
    • America/St_Kitts
    • America/St_Lucia
    • America/St_Thomas
    • America/St_Vincent
    • America/Swift_Current
    • America/Tegucigalpa
    • America/Thule
    • America/Thunder_Bay
    • America/Tijuana
    • America/Toronto
    • America/Tortola
    • America/Vancouver
    • America/Virgin
    • America/Whitehorse
    • America/Winnipeg
    • America/Yakutat
    • America/Yellowknife
    • Antarctica/Casey
    • Antarctica/Davis
    • Antarctica/DumontDUrville
    • Antarctica/Macquarie
    • Antarctica/Mawson
    • Antarctica/McMurdo
    • Antarctica/Palmer
    • Antarctica/Rothera
    • Antarctica/South_Pole
    • Antarctica/Syowa
    • Antarctica/Troll
    • Antarctica/Vostok
    • Arctic/Longyearbyen
    • Asia/Aden
    • Asia/Almaty
    • Asia/Amman
    • Asia/Anadyr
    • Asia/Aqtau
    • Asia/Aqtobe
    • Asia/Ashgabat
    • Asia/Ashkhabad
    • Asia/Atyrau
    • Asia/Baghdad
    • Asia/Bahrain
    • Asia/Baku
    • Asia/Bangkok
    • Asia/Barnaul
    • Asia/Beirut
    • Asia/Bishkek
    • Asia/Brunei
    • Asia/Calcutta
    • Asia/Chita
    • Asia/Choibalsan
    • Asia/Chongqing
    • Asia/Chungking
    • Asia/Colombo
    • Asia/Dacca
    • Asia/Damascus
    • Asia/Dhaka
    • Asia/Dili
    • Asia/Dubai
    • Asia/Dushanbe
    • Asia/Famagusta
    • Asia/Gaza
    • Asia/Harbin
    • Asia/Hebron
    • Asia/Ho_Chi_Minh
    • Asia/Hong_Kong
    • Asia/Hovd
    • Asia/Irkutsk
    • Asia/Istanbul
    • Asia/Jakarta
    • Asia/Jayapura
    • Asia/Jerusalem
    • Asia/Kabul
    • Asia/Kamchatka
    • Asia/Karachi
    • Asia/Kashgar
    • Asia/Kathmandu
    • Asia/Katmandu
    • Asia/Khandyga
    • Asia/Kolkata
    • Asia/Krasnoyarsk
    • Asia/Kuala_Lumpur
    • Asia/Kuching
    • Asia/Kuwait
    • Asia/Macao
    • Asia/Macau
    • Asia/Magadan
    • Asia/Makassar
    • Asia/Manila
    • Asia/Muscat
    • Asia/Nicosia
    • Asia/Novokuznetsk
    • Asia/Novosibirsk
    • Asia/Omsk
    • Asia/Oral
    • Asia/Phnom_Penh
    • Asia/Pontianak
    • Asia/Pyongyang
    • Asia/Qatar
    • Asia/Qostanay
    • Asia/Qyzylorda
    • Asia/Rangoon
    • Asia/Riyadh
    • Asia/Saigon
    • Asia/Sakhalin
    • Asia/Samarkand
    • Asia/Seoul
    • Asia/Shanghai
    • Asia/Singapore
    • Asia/Srednekolymsk
    • Asia/Taipei
    • Asia/Tashkent
    • Asia/Tbilisi
    • Asia/Tehran
    • Asia/Tel_Aviv
    • Asia/Thimbu
    • Asia/Thimphu
    • Asia/Tokyo
    • Asia/Tomsk
    • Asia/Ujung_Pandang
    • Asia/Ulaanbaatar
    • Asia/Ulan_Bator
    • Asia/Urumqi
    • Asia/Ust-Nera
    • Asia/Vientiane
    • Asia/Vladivostok
    • Asia/Yakutsk
    • Asia/Yangon
    • Asia/Yekaterinburg
    • Asia/Yerevan
    • Atlantic/Azores
    • Atlantic/Bermuda
    • Atlantic/Canary
    • Atlantic/Cape_Verde
    • Atlantic/Faeroe
    • Atlantic/Faroe
    • Atlantic/Jan_Mayen
    • Atlantic/Madeira
    • Atlantic/Reykjavik
    • Atlantic/South_Georgia
    • Atlantic/St_Helena
    • Atlantic/Stanley
    • Australia/ACT
    • Australia/Adelaide
    • Australia/Brisbane
    • Australia/Broken_Hill
    • Australia/Canberra
    • Australia/Currie
    • Australia/Darwin
    • Australia/Eucla
    • Australia/Hobart
    • Australia/LHI
    • Australia/Lindeman
    • Australia/Lord_Howe
    • Australia/Melbourne
    • Australia/NSW
    • Australia/North
    • Australia/Perth
    • Australia/Queensland
    • Australia/South
    • Australia/Sydney
    • Australia/Tasmania
    • Australia/Victoria
    • Australia/West
    • Australia/Yancowinna
    • Brazil/Acre
    • Brazil/DeNoronha
    • Brazil/East
    • Brazil/West
    • CET
    • CST6CDT
    • Canada/Atlantic
    • Canada/Central
    • Canada/Eastern
    • Canada/Mountain
    • Canada/Newfoundland
    • Canada/Pacific
    • Canada/Saskatchewan
    • Canada/Yukon
    • Chile/Continental
    • Chile/EasterIsland
    • Cuba
    • EET
    • EST5EDT
    • Egypt
    • Eire
    • Etc/GMT
    • Etc/GMT+0
    • Etc/GMT+1
    • Etc/GMT+10
    • Etc/GMT+11
    • Etc/GMT+12
    • Etc/GMT+2
    • Etc/GMT+3
    • Etc/GMT+4
    • Etc/GMT+5
    • Etc/GMT+6
    • Etc/GMT+7
    • Etc/GMT+8
    • Etc/GMT+9
    • Etc/GMT-0
    • Etc/GMT-1
    • Etc/GMT-10
    • Etc/GMT-11
    • Etc/GMT-12
    • Etc/GMT-13
    • Etc/GMT-14
    • Etc/GMT-2
    • Etc/GMT-3
    • Etc/GMT-4
    • Etc/GMT-5
    • Etc/GMT-6
    • Etc/GMT-7
    • Etc/GMT-8
    • Etc/GMT-9
    • Etc/GMT0
    • Etc/Greenwich
    • Etc/UCT
    • Etc/UTC
    • Etc/Universal
    • Etc/Zulu
    • Europe/Amsterdam
    • Europe/Andorra
    • Europe/Astrakhan
    • Europe/Athens
    • Europe/Belfast
    • Europe/Belgrade
    • Europe/Berlin
    • Europe/Bratislava
    • Europe/Brussels
    • Europe/Bucharest
    • Europe/Budapest
    • Europe/Busingen
    • Europe/Chisinau
    • Europe/Copenhagen
    • Europe/Dublin
    • Europe/Gibraltar
    • Europe/Guernsey
    • Europe/Helsinki
    • Europe/Isle_of_Man
    • Europe/Istanbul
    • Europe/Jersey
    • Europe/Kaliningrad
    • Europe/Kiev
    • Europe/Kirov
    • Europe/Kyiv
    • Europe/Lisbon
    • Europe/Ljubljana
    • Europe/London
    • Europe/Luxembourg
    • Europe/Madrid
    • Europe/Malta
    • Europe/Mariehamn
    • Europe/Minsk
    • Europe/Monaco
    • Europe/Moscow
    • Europe/Nicosia
    • Europe/Oslo
    • Europe/Paris
    • Europe/Podgorica
    • Europe/Prague
    • Europe/Riga
    • Europe/Rome
    • Europe/Samara
    • Europe/San_Marino
    • Europe/Sarajevo
    • Europe/Saratov
    • Europe/Simferopol
    • Europe/Skopje
    • Europe/Sofia
    • Europe/Stockholm
    • Europe/Tallinn
    • Europe/Tirane
    • Europe/Tiraspol
    • Europe/Ulyanovsk
    • Europe/Uzhgorod
    • Europe/Vaduz
    • Europe/Vatican
    • Europe/Vienna
    • Europe/Vilnius
    • Europe/Volgograd
    • Europe/Warsaw
    • Europe/Zagreb
    • Europe/Zaporozhye
    • Europe/Zurich
    • GB
    • GB-Eire
    • GMT
    • GMT0
    • Greenwich
    • Hongkong
    • Iceland
    • Indian/Antananarivo
    • Indian/Chagos
    • Indian/Christmas
    • Indian/Cocos
    • Indian/Comoro
    • Indian/Kerguelen
    • Indian/Mahe
    • Indian/Maldives
    • Indian/Mauritius
    • Indian/Mayotte
    • Indian/Reunion
    • Iran
    • Israel
    • Jamaica
    • Japan
    • Kwajalein
    • Libya
    • MET
    • MST7MDT
    • Mexico/BajaNorte
    • Mexico/BajaSur
    • Mexico/General
    • NZ
    • NZ-CHAT
    • Navajo
    • PRC
    • PST8PDT
    • Pacific/Apia
    • Pacific/Auckland
    • Pacific/Bougainville
    • Pacific/Chatham
    • Pacific/Chuuk
    • Pacific/Easter
    • Pacific/Efate
    • Pacific/Enderbury
    • Pacific/Fakaofo
    • Pacific/Fiji
    • Pacific/Funafuti
    • Pacific/Galapagos
    • Pacific/Gambier
    • Pacific/Guadalcanal
    • Pacific/Guam
    • Pacific/Honolulu
    • Pacific/Johnston
    • Pacific/Kanton
    • Pacific/Kiritimati
    • Pacific/Kosrae
    • Pacific/Kwajalein
    • Pacific/Majuro
    • Pacific/Marquesas
    • Pacific/Midway
    • Pacific/Nauru
    • Pacific/Niue
    • Pacific/Norfolk
    • Pacific/Noumea
    • Pacific/Pago_Pago
    • Pacific/Palau
    • Pacific/Pitcairn
    • Pacific/Pohnpei
    • Pacific/Ponape
    • Pacific/Port_Moresby
    • Pacific/Rarotonga
    • Pacific/Saipan
    • Pacific/Samoa
    • Pacific/Tahiti
    • Pacific/Tarawa
    • Pacific/Tongatapu
    • Pacific/Truk
    • Pacific/Wake
    • Pacific/Wallis
    • Pacific/Yap
    • Poland
    • Portugal
    • ROK
    • Singapore
    • SystemV/AST4
    • SystemV/AST4ADT
    • SystemV/CST6
    • SystemV/CST6CDT
    • SystemV/EST5
    • SystemV/EST5EDT
    • SystemV/HST10
    • SystemV/MST7
    • SystemV/MST7MDT
    • SystemV/PST8
    • SystemV/PST8PDT
    • SystemV/YST9
    • SystemV/YST9YDT
    • Turkey
    • UCT
    • US/Alaska
    • US/Aleutian
    • US/Arizona
    • US/Central
    • US/East-Indiana
    • US/Eastern
    • US/Hawaii
    • US/Indiana-Starke
    • US/Michigan
    • US/Mountain
    • US/Pacific
    • US/Samoa
    • UTC
    • Universal
    • W-SU
    • WET
    • Zulu
    • EST
    • HST
    • MST
    • ACT
    • AET
    • AGT
    • ART
    • AST
    • BET
    • BST
    • CAT
    • CNT
    • CST
    • CTT
    • EAT
    • ECT
    • IET
    • IST
    • JST
    • MIT
    • NET
    • NST
    • PLT
    • PNT
    • PRT
    • PST
    • SST
    • VST
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    true
  • Token
    The token to pass to Splunk.
    Display Name
    Token
    Description
    The token to pass to Splunk.
    API Name
    Token
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    false
  • Username
    The username to authenticate to Splunk.
    Display Name
    Username
    Description
    The username to authenticate to Splunk.
    API Name
    Username
    Expression Language Scope
    Not Supported
    Sensitive
    false
    Required
    false
State Management
Scopes Description
CLUSTER If using one of the managed Time Range Strategies, this processor will store the values of the latest and earliest times from the previous execution so that the next execution of the can pick up where the last execution left off. The state will be cleared and start over if the query is changed.
Relationships
Name Description
success Results retrieved from Splunk are sent out this relationship.
Writes Attributes
Name Description
splunk.query The query that performed to produce the FlowFile.
splunk.earliest.time The value of the earliest time that was used when performing the query.
splunk.latest.time The value of the latest time that was used when performing the query.