https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-query-that-uses-the-latest-function-with/m-p/419008#M120456 <P>@skoelpin yes same data same timestamp from last one year onwards</P> Tue, 04 Dec 2018 13:25:22 GMT james_n 2018-12-04T13:25:22Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-query-that-uses-the-latest-function-with/m-p/419005#M120453 <P>HI,</P> <P>I have a query <STRONG>index=something | timechart latest(fieldA) as datavalues by dataNames</STRONG>.</P> <P>when i select the time duration Today or Yesterday up to last 30days , it's working fine. If I select the last 3 months, it's displaying the wrong results. </P> <P>Can you please help me on this?</P> Tue, 04 Dec 2018 10:12:48 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-query-that-uses-the-latest-function-with/m-p/419005#M120453 james_n 2018-12-04T10:12:48Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-query-that-uses-the-latest-function-with/m-p/419006#M120454 <P>timechart has auto spaning depends on the time picker<BR /> see here: <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/timechart">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/timechart</A></P> Tue, 04 Dec 2018 13:19:30 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-query-that-uses-the-latest-function-with/m-p/419006#M120454 adonio 2018-12-04T13:19:30Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-query-that-uses-the-latest-function-with/m-p/419007#M120455 <P>Have you confirmed your timestamp is correct from 3 months ago?</P> Tue, 04 Dec 2018 13:19:40 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-query-that-uses-the-latest-function-with/m-p/419007#M120455 skoelpin 2018-12-04T13:19:40Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-query-that-uses-the-latest-function-with/m-p/419008#M120456 <P>@skoelpin yes same data same timestamp from last one year onwards</P> Tue, 04 Dec 2018 13:25:22 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-query-that-uses-the-latest-function-with/m-p/419008#M120456 james_n 2018-12-04T13:25:22Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-query-that-uses-the-latest-function-with/m-p/419009#M120457 <P>Can you post a screenshot of what you see and explain what you're looking to get? </P> <P>Are you referring to different time spans as you extend the time period?</P> Tue, 04 Dec 2018 14:46:09 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-query-that-uses-the-latest-function-with/m-p/419009#M120457 skoelpin 2018-12-04T14:46:09Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-query-that-uses-the-latest-function-with/m-p/419010#M120458 <P>Hey,</P> <P>How do you select "last 3 months"? Do you use any time snapping:<BR /> <span class="lia-inline-image-display-wrapper" image-alt="timechart_time_snipping"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6191iDC89DF516126746E/image-size/large?v=v2&amp;px=999" role="button" title="timechart_time_snipping" alt="timechart_time_snipping" /></span></P> <P>you can force the time using <CODE>earliest</CODE> and <CODE>latest</CODE> as filter:<BR /> <CODE>index=something earliest=-3mon latest=now</CODE></P> <P>Which is different to:<BR /> <CODE>index=something earliest=-3mon@m latest=@m</CODE></P> <P>Cheerz,<BR /> Björn</P> Tue, 04 Dec 2018 16:55:39 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-a-query-that-uses-the-latest-function-with/m-p/419010#M120458 bjoernjensen 2018-12-04T16:55:39Z