topic earliest=-1w does not work in Splunk Search

earliest=-1w does not work

GauriSplunk — Tue, 29 Sep 2020 07:50:07 GMT

Hi,
I have the following simple search.
sourcetype=ib:reserved1 source=ib:user:user_login index=ib_security earliest=-1w

When i run this search i do not get results. But when i remove the earliest command, I get the results.
All the results have todays date as time. So it should return result when I put earliest as 1 week back.

Why is earliest not working

Thanks

Re: earliest=-1w does not work

sundareshr — Tue, 29 Sep 2020 07:49:58 GMT

Does putting around source & sourcetype make any difference?

sourcetype="ib:reserved1" source="ib:user:user_login" index="ib_security" earliest=-1w

Re: earliest=-1w does not work

Richfez — Sun, 08 Nov 2015 20:27:14 GMT

No, I tried again with and without quotes around various pieces but just can't make it misbehave. I've also tried the various pieces individually and in various combinations. If GauriSplunk can reproduce this at will, I expect Splunk Support will definately want to take a look at this.

Re: earliest=-1w does not work

woodcock — Mon, 09 Nov 2015 06:27:14 GMT

I am sorry, I was careless and made a silly mistake in my testing and retract my confirmation of this problem. I am unable to reproduce it.

Re: earliest=-1w does not work

GauriSplunk — Mon, 09 Nov 2015 17:39:37 GMT

the date on my events was greater than current date. (maybe the date on that machine was wrongly set).
So I believe it takes latest as now by default.
so earliest=-1w and latest = now , it didnt match the events.

If it didnt take any default value for latest, it would have worked.

Re: earliest=-1w does not work

MuS — Mon, 09 Nov 2015 20:16:26 GMT

Hi GauriSplunk,

I converted your comment to an answer since it looks like you solved your time stamp issue/problem by setting a latest value in the search. Is that correct?

cheers, MuS

Re: earliest=-1w does not work

MuS — Mon, 09 Nov 2015 20:20:19 GMT

Running this search on Splunk 6.3.1 on Linux works:

index="_internal" sourcetype="splunkd" source="*metrics.log" earliest=-1w

It will return 450,072 events (before 11/10/15 9:19:03.378 AM)

Re: earliest=-1w does not work

GauriSplunk — Mon, 09 Nov 2015 21:02:28 GMT

yes. thanks