https://community.splunk.com/t5/Alerting/What-s-the-difference-in-dispatch-earliest-time-in-Splunk/m-p/684137#M15907 <P>Hi</P><P>it’s just like&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/251958">@P_vandereerden</a>&nbsp;said. You should read more about it from&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/SearchTimeModifiers#Specify_a_snap_to_time_unit" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/SearchTimeModifiers#Specify_a_snap_to_time_unit</A></P><P>r. Ismo</P> Sat, 13 Apr 2024 06:52:40 GMT isoutamo 2024-04-13T06:52:40Z https://community.splunk.com/t5/Alerting/What-s-the-difference-in-dispatch-earliest-time-in-Splunk/m-p/618044#M14445 <DIV class=""> <DIV class=""> <DIV class="">&nbsp;</DIV> </DIV> </DIV> <DIV class=""> <DIV class=""> <P>I am new to splunk, and trying to understand what’s the difference between dispatch.earliest_time = "-15m@m" and dispatch.earliest_time = "-15m”. Thanks!</P> </DIV> </DIV> Mon, 24 Oct 2022 13:12:50 GMT https://community.splunk.com/t5/Alerting/What-s-the-difference-in-dispatch-earliest-time-in-Splunk/m-p/618044#M14445 Fish_Salted 2022-10-24T13:12:50Z https://community.splunk.com/t5/Alerting/What-s-the-difference-in-dispatch-earliest-time-in-Splunk/m-p/684109#M15906 <P>Better late than never answering this, right?<BR /><BR />The part after the&nbsp;@ is a snap-to specifier that causes the search to start at the nearest value in that time unit. For example, if the time is 3:16:20, "-15m@m" will search from 3:01:00, where "-15m" will search from 3:01:20</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 12 Apr 2024 22:17:12 GMT https://community.splunk.com/t5/Alerting/What-s-the-difference-in-dispatch-earliest-time-in-Splunk/m-p/684109#M15906 P_vandereerden 2024-04-12T22:17:12Z https://community.splunk.com/t5/Alerting/What-s-the-difference-in-dispatch-earliest-time-in-Splunk/m-p/684137#M15907 <P>Hi</P><P>it’s just like&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/251958">@P_vandereerden</a>&nbsp;said. You should read more about it from&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/SearchTimeModifiers#Specify_a_snap_to_time_unit" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/SearchTimeModifiers#Specify_a_snap_to_time_unit</A></P><P>r. Ismo</P> Sat, 13 Apr 2024 06:52:40 GMT https://community.splunk.com/t5/Alerting/What-s-the-difference-in-dispatch-earliest-time-in-Splunk/m-p/684137#M15907 isoutamo 2024-04-13T06:52:40Z