which overrides first either time modifier or time range picker?

jmohan1984 — Fri, 12 Aug 2022 08:43:46 GMT

I have created Splunk query with time modifiers "earliest" and "latest" ( for eg. earliest="15/01/2022 8 am" latest="15/01/2022 10 pm" ) and also I have selected time range in the time ranger picker (for eg. 23/12/2022 8 am to 23/12/2022 10 pm)

Splunk Query:

timeformat="%m-%d-%Y %l:%M %p" earliest="15-01-2022 08:00 AM" latest="15-01-2022 10:00 PM" index="mobileApp" homepage

Time range picker values in UI:

From: 23/12/2022 8 am; To: 23/12/2022 10 pm

whenever, I click 'search' button, time range picker overrides the time modifiers earliest/latest values which are used in the Splunk query

Question:
could you please help me on overriding 'time range picker' values ( I need results between 15/01/2022 8 am to 15/01/2022 10 pm based on 'time modifiers' only)

Your answer would be greatly appreciated!

Re: which overrides first either time modifier or time range picker?

ITWhisperer — Fri, 12 Aug 2022 08:52:21 GMT

The times used for earliest and latest in your query should override the timepicker values. The job inspector should have a message saying this has happened

topic Re: which overrides first either time modifier or time range picker? in Splunk Search

which overrides first either time modifier or time range picker?

Re: which overrides first either time modifier or time range picker?