topic Re: what format should timestamp be in for starttime? in Getting Data In

what format should timestamp be in for starttime?

HattrickNZ — Wed, 02 Mar 2016 03:51:48 GMT

Regarding starttime from the docs

starttime starttime=<timestamp> Search from the specified date and time to the present (inclusive of the specified time).

What format should `` be in?

I have got this working starttime= 04/27/2015:00:00:00, that is mm/dd/yyyy, but I am seeing strange results, possibly duplicates in data. Can anyone advise?

For my reference this is in relation to this Q

Re: what format should timestamp be in for starttime?

richgalloway — Wed, 02 Mar 2016 13:17:30 GMT

starttime is deprecated and should be avoided. Use earliest, instead. That said, the timestamp format you used is correct. If you want to try a different format, use timeformat (another deprecated command).

I suggest you post a separate question with your search query and sample data so we can help resolve your "strange results".

Re: what format should timestamp be in for starttime?

HattrickNZ — Wed, 02 Mar 2016 19:41:31 GMT

I have done in the past and this was the solution then. Can I control earliest and latest date using fixed dates ? I will post it again, shall i?

Re: what format should timestamp be in for starttime?

HattrickNZ — Wed, 02 Mar 2016 19:49:50 GMT

posted a question here https://answers.splunk.com/answers/373591/can-i-control-earliest-and-latest-date-using-fixed-1.html