topic Refine Search, Create Alert, Search Time Range Changed!? in Alerting

Refine Search, Create Alert, Search Time Range Changed!?

andrewkenth — Fri, 27 Dec 2013 13:32:53 GMT

In Splunk 6 I am noticing that I when I refine a search and set a time range to Yesterday then save said search as an alert it saves the time range as Last 1 Day (no snap to) until now, instead of Yesterday. Yesterday could be relative but that would be Last 1 day (Beginning of day) until Today (Beginning of today).

Is this user error? A bug?

Thanks for your feedback!

Andrew

Re: Refine Search, Create Alert, Search Time Range Changed!?

di2esysadmin — Thu, 13 Feb 2014 21:15:23 GMT

I'm have a similar issue. Have saved a search to be "today". When I go back and edit it, it's set to "last 1 hour". Thus it isn't firing as it should.

Running 6.0.1.

I thank you as well.

Karla

Re: Refine Search, Create Alert, Search Time Range Changed!?

andrewkenth — Thu, 13 Feb 2014 21:28:41 GMT

I ended up not using the range picker (setting it to all time) and instead used the earliest= and latest= in my search query.