topic Cannot use earliest and latest for _time field newly converted from other field ? in Splunk Search

Cannot use earliest and latest for _time field newly converted from other field ?

sieutruc — Tue, 08 Jan 2013 15:25:17 GMT

Hello,

When i trigger a search like:

host="win20_oslo-ifs_CC-DC" index="sqlobj" | multikv | eval BusinessEpoch=strptime(BusinessDay,"%m/%d/%Y %I:%M:%S %p") | eval _time=BusinessEpoch  | table _time

It gives a table of _time field that is converted from BusinessDay, but if i use:

host="win20_oslo-ifs_CC-DC" index="sqlobj" | multikv | eval BusinessEpoch=strptime(BusinessDay,"%m/%d/%Y %I:%M:%S %p") | eval _time=BusinessEpoch  | search earliest=-1d latest=now | table _time

I've got no result , and i tried several times by changing the value of earliest or lastest but couldn't be successful. Can you suggest me what to do ?

Re: Cannot use earliest and latest for _time field newly converted from other field ?

Ayn — Tue, 08 Jan 2013 15:38:37 GMT

Did you try without "lastest"? Because that's a typo - it should be "latest"...

Re: Cannot use earliest and latest for _time field newly converted from other field ?

sieutruc — Tue, 08 Jan 2013 15:48:00 GMT

Thanks, yes i did one of both separately, but got no success too

Re: Cannot use earliest and latest for _time field newly converted from other field ?

sideview — Wed, 09 Jan 2013 02:20:55 GMT

The earliest and latest searchterms will only function in the search command when it's the initial search command in the pipeline. This is because those searchterms are really just a shorthand way to submit the "earliest" and "latest" arguments to the Splunk search API, back when the search is being dispatched initially.

So to filter by time further down in the search pipeline, I would use the "relative_time" function that's available in the eval and where commands.

Specifically :

| where _time>=relative_time(now(),"-1h") AND _time<now()

Re: Cannot use earliest and latest for _time field newly converted from other field ?

vbumgarner — Tue, 27 Jun 2017 18:16:22 GMT

So... side question...

Is there any way to "reset" the "search timeframe" so that all the "commands that bin" will honor a new "search timeframe" instead of the timeframe used in the original query?