topic Re: How to enable Splunk IT Service Intelligence to use earliest=@d modifier to execute search at midnight? in Splunk ITSI https://community.splunk.com/t5/Splunk-ITSI/How-to-enable-Splunk-IT-Service-Intelligence-to-use-earliest-d/m-p/203753#M20 <P>Are you sure the data is the same? Also, "earliest" and "latest" in a KPI Base Search is not recommended. We recommend that you use the KPI Interval option in the UI if you can.</P> Thu, 03 Nov 2016 21:06:28 GMT rossl_splunk 2016-11-03T21:06:28Z How to enable Splunk IT Service Intelligence to use earliest=@d modifier to execute search at midnight? https://community.splunk.com/t5/Splunk-ITSI/How-to-enable-Splunk-IT-Service-Intelligence-to-use-earliest-d/m-p/203750#M17 <P>When you write <CODE>earliest=@d</CODE>, it executes search from midnight in Splunk Cloud. But in Splunk IT Service Intelligence (ITSI), it executes from the last 24 hours. My preference is for ITSI to perform as it does in Splunk Cloud. So is this an issue in Splunk?</P> Wed, 02 Nov 2016 22:10:22 GMT https://community.splunk.com/t5/Splunk-ITSI/How-to-enable-Splunk-IT-Service-Intelligence-to-use-earliest-d/m-p/203750#M17 anveshdodda 2016-11-02T22:10:22Z Re: How to enable Splunk IT Service Intelligence to use earliest=@d modifier to execute search at midnight? https://community.splunk.com/t5/Splunk-ITSI/How-to-enable-Splunk-IT-Service-Intelligence-to-use-earliest-d/m-p/203751#M18 <P>Where are you defining that search? Is that in a KPI search? Also are you using a different version of ITSI than is installed on the cloud instance?</P> Thu, 03 Nov 2016 01:16:15 GMT https://community.splunk.com/t5/Splunk-ITSI/How-to-enable-Splunk-IT-Service-Intelligence-to-use-earliest-d/m-p/203751#M18 rossl_splunk 2016-11-03T01:16:15Z Re: How to enable Splunk IT Service Intelligence to use earliest=@d modifier to execute search at midnight? https://community.splunk.com/t5/Splunk-ITSI/How-to-enable-Splunk-IT-Service-Intelligence-to-use-earliest-d/m-p/203752#M19 <P>Hi ..<BR /> Thanks for your reply </P> <P>Yes it's in the kpi base search ...<BR /> I use the same one that is installed on the cloud instance ....<BR /> Also when i put kpi summary as off then I get the same count as I get in base core splunk but when I change the kpi summary to on that's where I get the kpi count different ...</P> Thu, 03 Nov 2016 02:15:08 GMT https://community.splunk.com/t5/Splunk-ITSI/How-to-enable-Splunk-IT-Service-Intelligence-to-use-earliest-d/m-p/203752#M19 anveshdodda 2016-11-03T02:15:08Z Re: How to enable Splunk IT Service Intelligence to use earliest=@d modifier to execute search at midnight? https://community.splunk.com/t5/Splunk-ITSI/How-to-enable-Splunk-IT-Service-Intelligence-to-use-earliest-d/m-p/203753#M20 <P>Are you sure the data is the same? Also, "earliest" and "latest" in a KPI Base Search is not recommended. We recommend that you use the KPI Interval option in the UI if you can.</P> Thu, 03 Nov 2016 21:06:28 GMT https://community.splunk.com/t5/Splunk-ITSI/How-to-enable-Splunk-IT-Service-Intelligence-to-use-earliest-d/m-p/203753#M20 rossl_splunk 2016-11-03T21:06:28Z