https://community.splunk.com/t5/Splunk-Search/Why-time-filter-value-range-is-not-being-passed-to-the-query/m-p/629078#M218508 <P>That's because you re-evaluated _time in the third line shown in the screenshot to "created_at".</P><LI-CODE lang="markup">| eval _time = created_at</LI-CODE><P>You data may have collected these events from Jan 30, but the field "created" has different values</P> Wed, 01 Feb 2023 04:39:10 GMT yuanliu 2023-02-01T04:39:10Z https://community.splunk.com/t5/Splunk-Search/Why-time-filter-value-range-is-not-being-passed-to-the-query/m-p/629077#M218507 <P>Does anyone know why the time range picker here on the right side (set to Yesterday Jan 30) cannot affect my _time data field in the query result? How to link them?&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="chongdong_0-1675219422905.png" style="width: 726px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23650iE635F446B397169F/image-dimensions/726x156?v=v2" width="726" height="156" role="button" title="chongdong_0-1675219422905.png" alt="chongdong_0-1675219422905.png" /></span></P> <P>&nbsp;</P> Wed, 01 Feb 2023 15:26:22 GMT https://community.splunk.com/t5/Splunk-Search/Why-time-filter-value-range-is-not-being-passed-to-the-query/m-p/629077#M218507 chongdong 2023-02-01T15:26:22Z https://community.splunk.com/t5/Splunk-Search/Why-time-filter-value-range-is-not-being-passed-to-the-query/m-p/629078#M218508 <P>That's because you re-evaluated _time in the third line shown in the screenshot to "created_at".</P><LI-CODE lang="markup">| eval _time = created_at</LI-CODE><P>You data may have collected these events from Jan 30, but the field "created" has different values</P> Wed, 01 Feb 2023 04:39:10 GMT https://community.splunk.com/t5/Splunk-Search/Why-time-filter-value-range-is-not-being-passed-to-the-query/m-p/629078#M218508 yuanliu 2023-02-01T04:39:10Z https://community.splunk.com/t5/Splunk-Search/Why-time-filter-value-range-is-not-being-passed-to-the-query/m-p/629205#M218557 <P>Got it. Thanks for the explanation. So is there a way to modify the time filter to point to my timestamp which is created_at?&nbsp;</P> Wed, 01 Feb 2023 18:37:54 GMT https://community.splunk.com/t5/Splunk-Search/Why-time-filter-value-range-is-not-being-passed-to-the-query/m-p/629205#M218557 chongdong 2023-02-01T18:37:54Z https://community.splunk.com/t5/Splunk-Search/Why-time-filter-value-range-is-not-being-passed-to-the-query/m-p/629305#M218604 <P>Yes. &nbsp;if you don't like your current _time at all, you can change your ingestion to use created_at as _time. (This is perhaps not the correct solution in most cases.)</P><P>At search time, you can use <A href="https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/definecalcfields#collapseDesktop7" target="_blank" rel="noopener">calculated field</A>&nbsp;to calculate epoch time from created_at and name it _time.</P> Thu, 02 Feb 2023 09:38:29 GMT https://community.splunk.com/t5/Splunk-Search/Why-time-filter-value-range-is-not-being-passed-to-the-query/m-p/629305#M218604 yuanliu 2023-02-02T09:38:29Z