topic Time Range "earliest" in SPL not working? in Splunk Search

Time Range "earliest" in SPL not working?

thahir — Thu, 06 Oct 2022 17:09:02 GMT

When conducting searches, we have observed that the SPL searches were not working based on the "earliest" time range in the SPL search itself.
It only worked when we choose the configured presents.

Re: Time Range "earliest" in SPL not working?

richgalloway — Thu, 06 Oct 2022 17:17:13 GMT

What you describe sounds the reverse of what should be happening. Please provide more information, especially the SPL you're using.

Re: Time Range "earliest" in SPL not working?

thahir — Thu, 06 Oct 2022 17:22:02 GMT

if i am seraching the index with earliest=-7d and searching with the time stamp for last 24 hours it should give the result for last 7 days but am getting the result for last 24 hours.

Re: Time Range "earliest" in SPL not working?

richgalloway — Thu, 06 Oct 2022 17:35:21 GMT

That is the way it is supposed to work, but we can't debug this problem without seeing your code. Make sure the "earliest" keyword is before the first pipe (|).