topic Re: search with subsearch failes if earliest and latest is used in Splunk Search

Why does search with subsearch fail if earliest and latest is used?

FritzWittwer — Thu, 21 Apr 2022 14:36:31 GMT

The following search does not produce any results:

index=* earliest="04/19/2022:15:00:00" latest="04/19/2022:17:00:00"
| fields _time, index, sourcetype | head 1
| eval mail=[| makeresults | eval mail="\"abc@cde.com\"" | return $mail]

The search and the sub search produce each one result.
The search returns one result as expected when the the earliest and latest option in the base search are omitted.

Re: search with subsearch failes if earliest and latest is used

isoutamo — Thu, 21 Apr 2022 05:56:12 GMT

Your search is valid. Are you sure that you have events on this time slot?

r. Ismo

Re: search with subsearch failes if earliest and latest is used

FritzWittwer — Thu, 21 Apr 2022 06:33:10 GMT

Yes, the first search alone produces exactly one result as stated in the question. In case it is executed on a less busy instance the time range must be expanded by changing earliest and/or latests.

Re: search with subsearch failes if earliest and latest is used

isoutamo — Thu, 21 Apr 2022 06:40:07 GMT

Can you find anything interesting from search.log via Job Inspector?

Re: search with subsearch failes if earliest and latest is used

FritzWittwer — Thu, 21 Apr 2022 06:57:09 GMT

No, just one error message in the 1700 lines which also spears if the earliest and latest are deleted and the search runs as expected.

Re: search with subsearch failes if earliest and latest is used

bowesmana — Thu, 21 Apr 2022 07:07:18 GMT

That's strange - I ran a similar search on Splunk 8.0.1 and it gives me the correct search range, but on 8.2.1 I get this

What version of Splunk do you have?

Re: search with subsearch failes if earliest and latest is used

FritzWittwer — Thu, 21 Apr 2022 09:04:04 GMT

I am on 8.2.3 and the time range fits: