https://community.splunk.com/t5/Splunk-Enterprise/Drill-down-Search-Earliest-Latest-Offset/m-p/707096#M21133 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/274908">@Splunk_Fabi</a>&nbsp;Hello, which version of ES are you using? I have seen a similar bug in 7.3.2 (a fix might be on the future roadmap). If you are on 7.3.2, please file a ticket with Splunk Support to expedite the issue.</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>If this Helps, Please Upvote.</P><P>&nbsp;</P><P>&nbsp;</P> Wed, 18 Dec 2024 03:46:56 GMT sainag_splunk 2024-12-18T03:46:56Z https://community.splunk.com/t5/Splunk-Enterprise/Drill-down-Search-Earliest-Latest-Offset/m-p/706901#M21100 <P>When I edit a correlation search, I want to configure the time of the drill-down search.&nbsp;<BR /><BR />If I put "1h" in the form "Earliest Offset", it inputs the unix time stamp in milliseconds. Splunk expects the unix time stamp in seconds. Is there a workaround for this issue?<BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Splunk_Fabi_1-1734358080924.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/33863i9E894BD06C496009/image-size/medium?v=v2&amp;px=400" role="button" title="Splunk_Fabi_1-1734358080924.png" alt="Splunk_Fabi_1-1734358080924.png" /></span></P><P>-&gt;&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Splunk_Fabi_2-1734358160494.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/33864i188DA6EA7E05AE4C/image-size/medium?v=v2&amp;px=400" role="button" title="Splunk_Fabi_2-1734358160494.png" alt="Splunk_Fabi_2-1734358160494.png" /></span></P><P><BR />Correct would be:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Splunk_Fabi_3-1734358215056.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/33865i572CBCCA80A97D18/image-size/medium?v=v2&amp;px=400" role="button" title="Splunk_Fabi_3-1734358215056.png" alt="Splunk_Fabi_3-1734358215056.png" /></span></P><P>&nbsp;</P><P>&nbsp;</P> Mon, 16 Dec 2024 14:11:15 GMT https://community.splunk.com/t5/Splunk-Enterprise/Drill-down-Search-Earliest-Latest-Offset/m-p/706901#M21100 Splunk_Fabi 2024-12-16T14:11:15Z https://community.splunk.com/t5/Splunk-Enterprise/Drill-down-Search-Earliest-Latest-Offset/m-p/707096#M21133 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/274908">@Splunk_Fabi</a>&nbsp;Hello, which version of ES are you using? I have seen a similar bug in 7.3.2 (a fix might be on the future roadmap). If you are on 7.3.2, please file a ticket with Splunk Support to expedite the issue.</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>If this Helps, Please Upvote.</P><P>&nbsp;</P><P>&nbsp;</P> Wed, 18 Dec 2024 03:46:56 GMT https://community.splunk.com/t5/Splunk-Enterprise/Drill-down-Search-Earliest-Latest-Offset/m-p/707096#M21133 sainag_splunk 2024-12-18T03:46:56Z