topic Time modifier for Time range in Searches & Reports in Dashboards & Visualizations

Time modifier for Time range in Searches & Reports

batcave — Mon, 04 Feb 2013 04:34:47 GMT

The following time modifier:

earliest="5/11/2012:20:00:00" latest="12/11/2012:20:00:00"

works when used inline with search query. But when these values are used as Time Range for saved searches in Manager> Searches & Reports , it gives an error.

Any ideas how to include such time modifiers for saving searches from the Manager?

Re: Time modifier for Time range in Searches & Reports

sbrant_splunk — Mon, 04 Feb 2013 05:10:08 GMT

The "Start time" and "Finish time" fields in the saved searches page are for relative time modifiers, not exact date/time. If you did want to save the search to run over exact times, you can still leave the "earliest" and "latest" terms in your search. The "Start time" and "Finish time" fields are not required for the saved search.