posting earliest / latest to Splunk API